Overview

overview

10

Static

static

3

2026-07-04...at.exe

windows10-2004-x64

10

2026-07-04...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 02:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_6c55cfe8ebbddab5f5cec728878da0a2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe
  • Size 689KB
  • Sample260704-cjdeeaat3t
  • SHA256 ddad3e3ccd5209b52da8b2cba191d0b150fcf9d7e8c52ff3710342aef364c831
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoverymedusaransomwarepersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • F:\$RECYCLE.BIN\!!!READ_ME_MEDUSA!!!.txt

Ransom Note
  • $$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Wings To Go !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. We have penetrated your entire network and researched all about your data. And we have copied all of your confidential data and uploaded to private storage. 2. We have ENCRYPTED your files. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your critial data to the public and send emails to your competitors. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues. After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 2 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/ http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( [email protected] ) Company identification hash: dbd7a08e9e4e35ddfe197d69b5b0aa17bc7ee1c91b3ed8a104a18323f8fde51b
URLs

  • http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/

  • http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/

  • http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d

Signatures

  • Family: Medusa Ransomware

    Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.

    ransomwaremedusaransomware
  • Renames multiple (9768) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 44 IoCs
    defense_evasion
  • Modifies registry class 17 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_6c55cfe8ebbddab5f5cec728878da0a2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_6c55cfe8ebbddab5f5cec728878da0a2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\net.exe
      net stop "Acronis VSS Provider" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
        3⤵
          PID:2616
      • C:\Windows\SysWOW64\net.exe
        net stop "Enterprise Client Service" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6024
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Enterprise Client Service" /y
          3⤵
            PID:5524
        • C:\Windows\SysWOW64\net.exe
          net stop "Sophos Agent" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1300
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Sophos Agent" /y
            3⤵
              PID:2772
          • C:\Windows\SysWOW64\net.exe
            net stop "Sophos AutoUpdate Service" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:864
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
              3⤵
                PID:2456
            • C:\Windows\SysWOW64\net.exe
              net stop "Sophos Clean Service" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4612
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Sophos Clean Service" /y
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1284
            • C:\Windows\SysWOW64\net.exe
              net stop "Sophos Device Control Service" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:704
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3416
            • C:\Windows\SysWOW64\net.exe
              net stop "Sophos File Scanner Service" /y
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5408
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
                3⤵
                  PID:5928
              • C:\Windows\SysWOW64\net.exe
                net stop "Sophos Health Service" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2136
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Sophos Health Service" /y
                  3⤵
                    PID:5044
                • C:\Windows\SysWOW64\net.exe
                  net stop "Sophos MCS Agent" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5596
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
                    3⤵
                      PID:5760
                  • C:\Windows\SysWOW64\net.exe
                    net stop "Sophos MCS Client" /y
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5876
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
                      3⤵
                        PID:924
                    • C:\Windows\SysWOW64\net.exe
                      net stop "Sophos Message Router" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2608
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "Sophos Message Router" /y
                        3⤵
                          PID:1060
                      • C:\Windows\SysWOW64\net.exe
                        net stop "Sophos Safestore Service" /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4952
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
                          3⤵
                            PID:1748
                        • C:\Windows\SysWOW64\net.exe
                          net stop "Sophos System Protection Service" /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2940
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
                            3⤵
                              PID:3908
                          • C:\Windows\SysWOW64\net.exe
                            net stop "Sophos Web Control Service" /y
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2780
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5448
                          • C:\Windows\SysWOW64\net.exe
                            net stop "SQLsafe Backup Service" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:460
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1788
                          • C:\Windows\SysWOW64\net.exe
                            net stop "SQLsafe Filter Service" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5360
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
                              3⤵
                                PID:5936
                            • C:\Windows\SysWOW64\net.exe
                              net stop "Symantec System Recovery" /y
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4988
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop "Symantec System Recovery" /y
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:2360
                            • C:\Windows\SysWOW64\net.exe
                              net stop "Veeam Backup Catalog Data Service" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2916
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:256
                            • C:\Windows\SysWOW64\net.exe
                              net stop "AcronisAgent" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2600
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop "AcronisAgent" /y
                                3⤵
                                  PID:2436
                              • C:\Windows\SysWOW64\net.exe
                                net stop "AcrSch2Svc" /y
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:6000
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop "AcrSch2Svc" /y
                                  3⤵
                                    PID:1388
                                • C:\Windows\SysWOW64\net.exe
                                  net stop "Antivirus" /y
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:872
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop "Antivirus" /y
                                    3⤵
                                      PID:5616
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop "ARSM" /y
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3768
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop "ARSM" /y
                                      3⤵
                                        PID:1504
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop "BackupExecAgentAccelerator" /y
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2816
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
                                        3⤵
                                          PID:4904
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop "BackupExecAgentBrowser" /y
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1988
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
                                          3⤵
                                            PID:3888
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop "BackupExecDeviceMediaService" /y
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4884
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
                                            3⤵
                                              PID:4616
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop "BackupExecJobEngine" /y
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1576
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
                                              3⤵
                                                PID:3224
                                            • C:\Windows\SysWOW64\net.exe
                                              net stop "BackupExecManagementService" /y
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4652
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop "BackupExecManagementService" /y
                                                3⤵
                                                  PID:5648
                                              • C:\Windows\SysWOW64\net.exe
                                                net stop "BackupExecRPCService" /y
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4464
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop "BackupExecRPCService" /y
                                                  3⤵
                                                    PID:1080
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop "BackupExecVSSProvider" /y
                                                  2⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1784
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
                                                    3⤵
                                                      PID:6072
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net stop "bedbg" /y
                                                    2⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2660
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop "bedbg" /y
                                                      3⤵
                                                        PID:2328
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net stop "DCAgent" /y
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:452
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop "DCAgent" /y
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2992
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net stop "EPSecurityService" /y
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2568
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop "EPSecurityService" /y
                                                        3⤵
                                                          PID:3628
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net stop "EPUpdateService" /y
                                                        2⤵
                                                          PID:1668
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop "EPUpdateService" /y
                                                            3⤵
                                                              PID:5164
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net stop "EraserSvc11710" /y
                                                            2⤵
                                                              PID:2504
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop "EraserSvc11710" /y
                                                                3⤵
                                                                  PID:6080
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop "EsgShKernel" /y
                                                                2⤵
                                                                  PID:3372
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop "EsgShKernel" /y
                                                                    3⤵
                                                                      PID:1136
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    net stop "FA_Scheduler" /y
                                                                    2⤵
                                                                      PID:1264
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop "FA_Scheduler" /y
                                                                        3⤵
                                                                          PID:4512
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        net stop "IISAdmin" /y
                                                                        2⤵
                                                                          PID:1624
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop "IISAdmin" /y
                                                                            3⤵
                                                                              PID:1072
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            net stop "IMAP4Svc" /y
                                                                            2⤵
                                                                              PID:5712
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop "IMAP4Svc" /y
                                                                                3⤵
                                                                                  PID:4524
                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                net stop "macmnsvc" /y
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:476
                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                  C:\Windows\system32\net1 stop "macmnsvc" /y
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1256
                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                net stop "masvc" /y
                                                                                2⤵
                                                                                  PID:5412
                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                    C:\Windows\system32\net1 stop "masvc" /y
                                                                                    3⤵
                                                                                      PID:5400
                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                    net stop "MBAMService" /y
                                                                                    2⤵
                                                                                      PID:796
                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                        C:\Windows\system32\net1 stop "MBAMService" /y
                                                                                        3⤵
                                                                                          PID:4644
                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                        net stop "MBEndpointAgent" /y
                                                                                        2⤵
                                                                                          PID:3624
                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                            C:\Windows\system32\net1 stop "MBEndpointAgent" /y
                                                                                            3⤵
                                                                                              PID:4388
                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                            net stop "McAfeeEngineService" /y
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5436
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop "McAfeeEngineService" /y
                                                                                              3⤵
                                                                                                PID:2272
                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                              net stop "McAfeeFramework" /y
                                                                                              2⤵
                                                                                                PID:5780
                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                  C:\Windows\system32\net1 stop "McAfeeFramework" /y
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3132
                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                net stop "McAfeeFrameworkMcAfeeFramework" /y
                                                                                                2⤵
                                                                                                  PID:3300
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
                                                                                                    3⤵
                                                                                                      PID:2296
                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                    net stop "McShield" /y
                                                                                                    2⤵
                                                                                                      PID:1340
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop "McShield" /y
                                                                                                        3⤵
                                                                                                          PID:5656
                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                        net stop "McTaskManager" /y
                                                                                                        2⤵
                                                                                                          PID:900
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop "McTaskManager" /y
                                                                                                            3⤵
                                                                                                              PID:3128
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net stop "mfemms" /y
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5236
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop "mfemms" /y
                                                                                                              3⤵
                                                                                                                PID:4972
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net stop "mfevtp" /y
                                                                                                              2⤵
                                                                                                                PID:4768
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 stop "mfevtp" /y
                                                                                                                  3⤵
                                                                                                                    PID:5660
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net stop "MMS" /y
                                                                                                                  2⤵
                                                                                                                    PID:1656
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop "MMS" /y
                                                                                                                      3⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5204
                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                    net stop "mozyprobackup" /y
                                                                                                                    2⤵
                                                                                                                      PID:3944
                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                        C:\Windows\system32\net1 stop "mozyprobackup" /y
                                                                                                                        3⤵
                                                                                                                          PID:1308
                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                        net stop "MsDtsServer" /y
                                                                                                                        2⤵
                                                                                                                          PID:5856
                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop "MsDtsServer" /y
                                                                                                                            3⤵
                                                                                                                              PID:4232
                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                            net stop "MsDtsServer100" /y
                                                                                                                            2⤵
                                                                                                                              PID:5476
                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop "MsDtsServer100" /y
                                                                                                                                3⤵
                                                                                                                                  PID:4672
                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                net stop "MsDtsServer110" /y
                                                                                                                                2⤵
                                                                                                                                  PID:1228
                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                    C:\Windows\system32\net1 stop "MsDtsServer110" /y
                                                                                                                                    3⤵
                                                                                                                                      PID:3912
                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                    net stop "MSExchangeES" /y
                                                                                                                                    2⤵
                                                                                                                                      PID:700
                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                        C:\Windows\system32\net1 stop "MSExchangeES" /y
                                                                                                                                        3⤵
                                                                                                                                          PID:1684
                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                        net stop "MSExchangeIS" /y
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4828
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 stop "MSExchangeIS" /y
                                                                                                                                          3⤵
                                                                                                                                            PID:204
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net stop "MSExchangeMGMT" /y
                                                                                                                                          2⤵
                                                                                                                                            PID:5352
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
                                                                                                                                              3⤵
                                                                                                                                                PID:2124
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net stop "MSExchangeMTA" /y
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5384
                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                C:\Windows\system32\net1 stop "MSExchangeMTA" /y
                                                                                                                                                3⤵
                                                                                                                                                  PID:2628
                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                net stop "MSExchangeSA" /y
                                                                                                                                                2⤵
                                                                                                                                                  PID:3916
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 stop "MSExchangeSA" /y
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5788
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "MSExchangeSRS" /y
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1524
                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                        C:\Windows\system32\net1 stop "MSExchangeSRS" /y
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3304
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net stop "MSOLAP$SQL_2008" /y
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5376
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4596
                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                          net stop "MSOLAP$SYSTEM_BGC" /y
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1512
                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                              C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4376
                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                              net stop "MSOLAP$TPS" /y
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5060
                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4500
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net stop "MSOLAP$TPSAMA" /y
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4900
                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2212
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "MSSQL$BKUPEXEC" /y
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:972
                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2128
                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                          net stop "MSSQL$ECWDB2" /y
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5744
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2676
                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                              net stop "MSSQL$PRACTICEMGT" /y
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3236
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5048
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "MSSQL$PRACTTICEBGC" /y
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1020
                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2384
                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                    net stop "MSSQL$PROFXENGAGEMENT" /y
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1756
                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                        C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5756
                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                        net stop "MSSQL$SBSMONITORING" /y
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2280
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5108
                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                            net stop "MSSQL$SHAREPOINT" /y
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2640
                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                net stop "MSSQL$SQL_2008" /y
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                  net stop "MSSQL$SYSTEM_BGC" /y
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5800
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                      net stop "MSSQL$TPS" /y
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQL$TPS" /y
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                          net stop "MSSQL$TPSAMA" /y
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5276
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                              net stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4844
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                  net stop "MSSQL$VEEAMSQL2012" /y
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5248
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                      net stop "MSSQLFDLauncher" /y
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2316
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                          net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                              net stop "MSSQLFDLauncher$SBSMONITORING" /y
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                  net stop "MSSQLFDLauncher$SHAREPOINT" /y
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                      net stop "MSSQLFDLauncher$SQL_2008" /y
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:428
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                          net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2144
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                            net stop "MSSQLFDLauncher$TPS" /y
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                net stop "MSSQLFDLauncher$TPSAMA" /y
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2228
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                    net stop "MSSQLSERVER" /y
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:292
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "MSSQLSERVER" /y
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                        net stop "MSSQLServerADHelper100" /y
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3468
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                            net stop "MSSQLServerOLAPService" /y
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                net stop "MySQL80" /y
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MySQL80" /y
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:544
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "MySQL57" /y
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3436
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "MySQL57" /y
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                      net stop "ntrtscan" /y
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "ntrtscan" /y
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4016
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                        net stop "OracleClientCache80" /y
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "OracleClientCache80" /y
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            net stop "PDVFSService" /y
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:3632
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "PDVFSService" /y
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2408
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                net stop "POP3Svc" /y
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "POP3Svc" /y
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:688
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                    net stop "ReportServer" /y
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "ReportServer" /y
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                        net stop "ReportServer$SQL_2008" /y
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                            net stop "ReportServer$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3144
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                net stop "ReportServer$TPS" /y
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                    net stop "ReportServer$TPSAMA" /y
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:3880
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                        net stop "RESvc" /y
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1776
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "RESvc" /y
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                          net stop "sacsvr" /y
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:5240
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "sacsvr" /y
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1916
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                            net stop "SamSs" /y
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1676
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SamSs" /y
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:3140
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                net stop "SAVAdminService" /y
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SAVAdminService" /y
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                  net stop "SAVService" /y
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SAVService" /y
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                    net stop "SDRSVC" /y
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2644
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "SDRSVC" /y
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:3396
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                        net stop "SepMasterService" /y
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SepMasterService" /y
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                            net stop "ShMonitor" /y
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "ShMonitor" /y
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                net stop "Smcinst" /y
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Smcinst" /y
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                    net stop "SmcService" /y
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "SmcService" /y
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:356
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                      net stop "SMTPSvc" /y
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:336
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SMTPSvc" /y
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                          net stop "SNAC" /y
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SNAC" /y
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                              net stop "SntpService" /y
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SntpService" /y
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                  net stop "sophossps" /y
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5896
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "sophossps" /y
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2032
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                    net stop "SQLAgent$BKUPEXEC" /y
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                        net stop "SQLAgent$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:1528
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                        net stop "SQLAgent$PRACTTICEBGC" /y
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4132
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                            net stop "SQLAgent$PRACTTICEMGT" /y
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$SBSMONITORING" /y
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLAgent$SHAREPOINT" /y
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$TPS" /y
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2012
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                    net stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLAgent$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLBrowser" /y
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLBrowser" /y
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3924
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLSafeOLRService" /y
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLSERVERAGENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:620
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLTELEMETRY" /y
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:712
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLTELEMETRY$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLWriter" /y
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLWriter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SstpSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SstpSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "svcGenericHost" /y
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "svcGenericHost" /y
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "swi_filter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "swi_filter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "swi_service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "swi_service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "swi_update_64" /y
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "swi_update_64" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "TmCCSF" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "TmCCSF" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "tmlisten" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "tmlisten" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "TrueKey" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "TrueKey" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "TrueKeyScheduler" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "TrueKeyServiceHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "UI0Detect" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "UI0Detect" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "VeeamBackupSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "VeeamBrokerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "VeeamCatalogSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "VeeamCloudSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "VeeamDeploymentService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "VeeamDeploySvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "VeeamEnterpriseManagerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "VeeamMountSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "VeeamMountSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "VeeamNFSSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "VeeamRESTSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "VeeamTransportSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "W3Svc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "W3Svc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "WRSVC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "WRSVC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "VeeamHvIntegrationSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "swi_update" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "swi_update" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "SQLAgent$CXDB" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$CITRIX_METAFRAME" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQL Backups" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SQL Backups" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "MSSQL$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQL$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "Zoolz 2 Service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "MSSQLServerADHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "msftesql$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "msftesql$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "NetMsmqActivator" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "NetMsmqActivator" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "EhttpSrv" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "EhttpSrv" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "ekrn" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "ekrn" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "ESHASRV" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "ESHASRV" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "MSSQL$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "AVP" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "AVP" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "klnagent" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "klnagent" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "MSSQL$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "kavfsslp" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "kavfsslp" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "KAVFSGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "KAVFSGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "KAVFS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "KAVFS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "mfefire" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "mfefire" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM zoolz.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM agntsvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM dbeng50.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM dbsnmp.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM encsvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM excel.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM firefoxconfig.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM infopath.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM isqlplussvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM msaccess.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM msftesql.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mspub.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mydesktopqos.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mydesktopservice.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mysqld.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mysqld-nt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mysqld-opt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM ocautoupds.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM ocomm.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM ocssd.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM onenote.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM oracle.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM outlook.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM powerpnt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM sqbcoreservice.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM sqlagent.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM sqlbrowser.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM sqlservr.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM sqlwriter.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM steam.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM synctime.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM tbirdconfig.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM thebat.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM thebat64.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM thunderbird.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM visio.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM winword.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM wordpad.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM xfssvccon.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM tmlisten.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM PccNTMon.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM CNTAoSMgr.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM Ntrtscan.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /F /IM mbamtray.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\2026-07-04_6c55cfe8ebbddab5f5cec728878da0a2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping localhost -n 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2420 -ip 2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\userinit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5560

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Credential Manager

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network Share Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1135

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\$Recycle.Bin\S-1-5-21-3047816590-610495838-277027736-1000\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 488B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7c7ff6d48d9afffe985353cd151389979f5074e002bd4172eb7352cbee0c3fb7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        stable.identity_helper.exe.manifest
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 418a185ea93f2cc3be21ddcc932228bd6cc7f7d330f6afa9ede917bfdc2bb61b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        resources.pak
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\resources.pak
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 33.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 dd8e0698d221974a775c2607961a8daa5f5c7dddc4e6a42f69f844c2951825fe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        identity_helper.Sparse.Stable.msix.DATA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 57KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9b21cb15b3a75fd87b1d455d6d63ede45fabf3bcc1728e2f145cd3bc70b538c9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cversions.2.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8c005abd01b8e77c2b4d75cfcac0eb7c65c71b1999df110d4344b4dfafa4752d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 297KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c67461772f8c59705575ba35933640df93ebbfce38b70cdcb248a7e1a4cae21d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 297KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5a5d3841efcdc9540c54030fbc8b3b5ca06856e65a0615cfdf53c6369be36084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 639KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 234637b056adb9f8ec55a929ad39aaa590324d17ff126b17a17a56b4de84c3eb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ADDLIMIT.DOCM.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\ADDLIMIT.DOCM.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 450KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 848c9e4a68289430e4157be98da82998dcd49572b1cc29dc08ef74503bff27fe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        APPROVEFORMAT.ADT.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\APPROVEFORMAT.ADT.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 567KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 209b553f891f0be10e846a564cd81a2a9226f6cfa561760b1833211d46172c9e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ASSERTJOIN.MID.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\ASSERTJOIN.MID.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 274KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 dc39fa38798c2a28d1b9eca066c4f9a5a76b3e20c423b1c30858ad5525b708be
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CONVERTFROMHIDE.JS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\CONVERTFROMHIDE.JS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 665KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ea4d6c1aef765e80a184008e9ef0c473dbf0b1af618b67fb45b95c14605144c5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        COPYSKIP.XPS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\COPYSKIP.XPS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 645KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 193e753fab65793e0fdff3ee10e03869ed480d48fdb1ec8e656196632e35277b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        DISABLERESUME.AU.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\DISABLERESUME.AU.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 235KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a1e2afbcd4ecdb8128f54037ed82ce48e2d4eb62d3ffce75b0320c886ddaf405
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        DISMOUNTDISCONNECT.EX_.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\DISMOUNTDISCONNECT.EX_.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 469KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 df2477236f33a06dffd081cfe47d95291a36ff3a1169bb1cfef3a0720424b78b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ENABLEREQUEST.DVR-MS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\ENABLEREQUEST.DVR-MS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 528KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d922ab1a929e02e00d56f6ffb1d9b318f31b0b7f6ac09d09ecb698320f96b92c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        EXPANDLOCK.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\EXPANDLOCK.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d4cd1976475e12040fe0b77bb4f669b3e16bfb222c7960705dcfb1690fee8b8c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GRANTAPPROVE.ZIP.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\GRANTAPPROVE.ZIP.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 254KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cd4231d30564d0a4b267393a741c55bc77a143e67941e5da5a766d5bbbdd0035
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        INVOKEASSERT.3G2.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\INVOKEASSERT.3G2.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 411KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0c2accebb5d1ec75d2aac60330f33b095ed6d00be4b74b3316741b0f341a30de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        OPTIMIZEAPPROVE.FON.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\OPTIMIZEAPPROVE.FON.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 587KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d8fc85f9b53730becf4565390b710481039a82862ae25c6f76a3c6b2184b9c3a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        POPWAIT.EDRWX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\POPWAIT.EDRWX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 508KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 924d0aac7f2756b970c71c7be4efd6f636224ec40f6920cfcd1f30a895dd9cff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PUSHREGISTER.M4A.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\PUSHREGISTER.M4A.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 430KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 900bc984d28dbd0748ef531121f881247daf1f809f5fb0ec9f2570cea1fb08e3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        READRESOLVE.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\READRESOLVE.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 38b2ecbadcc00a2b3bbab75ac2b903d61dc36fd486807efc9c8751262c0e315c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        REDORESUME.WMF.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\REDORESUME.WMF.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 313KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ec514058edb6dbc2cdd73b5097dec0f7b63a8dce1f85a899e253c618da3ddd0b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        REGISTEROPEN.OGG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\REGISTEROPEN.OGG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 391KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 57ae436306c5e9c62da71ace1de15bcc2a1b873388c767a7345813a520243d56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        RESIZEIMPORT.WMF.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\RESIZEIMPORT.WMF.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 919KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0e77a909b5bfcd0b3d4884ab022f40dae3f17dc3f53da7762db7a7a21ebe301a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        RESUMECHECKPOINT.RAW.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\RESUMECHECKPOINT.RAW.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 293KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7f09056229af89c0b46a8ffd2219fc02b699862bfdde30eb32b4801d4d19d6d7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHOWUNREGISTER.MPG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\SHOWUNREGISTER.MPG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 489KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9f7da69463adf456b100881c4d54f987460b7a2372c1af873245b738971df2ab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SPLITASSERT.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\SPLITASSERT.DOCX.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 72bcc2c0f94aa33c32f88d45b893bf0c9c89d4f64f3c70583e8a52f51d7bb115
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SPLITEXIT.OGG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\SPLITEXIT.OGG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 547KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3eaaee3d0b0826edc7129cdd3f5b455da96ed3e397094960a2d7b77782145aea
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        UNDOPUSH.M4A.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\UNDOPUSH.M4A.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 606KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8e6ad37e9f810e441182387284fd58d02884cc3ce64eb5900462cddb5118d016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        UNPROTECTFORMAT.SQL.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\UNPROTECTFORMAT.SQL.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 371KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 79c363284c422ff0956ea62a3f0038aeeb0f2faf07e59ed04874d0a7ebeec7f3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        USECOMPLETE.SEARCH-MS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\USECOMPLETE.SEARCH-MS.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 332KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a69f902e10cb27d4a8e1c335f8c54db1997ceb96cefabd9abdfaead1d92b29a5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        WRITERESTART.MPEG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\USERS\ADMIN\DESKTOP\WRITERESTART.MPEG.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 626KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 bc9c0dbeb3a880856d3b0dd7419e2ab6a1c038675cfaa336d48a66b75dec545b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StructuredQuerySchema.bin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 423KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cedbd149190551284255c52a0ad1ae58a6213d181b7516680075343346835aeb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 174B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        {03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 423KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cd5c9809760fa697626465d3e5cb1a8d3ec16519923e0941e33312bd0c89400b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 83KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 56ea9bdb6fb0c3bdee05221272d8de9a561700c24227bb53548555588d42af95
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_16.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8528c03446efa8ef08b0486940c498b2bc0d673c6d0bb463b3eb62fcd55dfade
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_32.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f4bd1fe6d0dcd2275900f6d57b073033939fc0d3233a06fee558592f065a1053
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5d58db9702f5b966f21a3acb980f6b2e50cc5a524afbed5be2ba8c8046aaac60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b1e3ddea5455cb266de20f8b6888b186a256f5d60ec86dab561d81e30f197173
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 42833ee211714076825d9642a7f6f5df059dbed3f853f907392c4b862aa77cde
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 77b7d75cfdcc4ad609bb8fd01a3b67d85f8d96b8eb69ef85b55ba393db2740b3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        thumbcache_256.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9e405e76ea8d6e1ac878b92f6559e165a1026c4bcd820b5c07e860d684ea9c5c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        thumbcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 24B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        thumbcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8a126d68ddb20bdbf29ec4fb248c69e6bf45a9a51e399a628cf58323f9ac5fa6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 57876426149b74d0b987183bef798f1aa5c6874a11b1d7f7ad939c7ad5fad414
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 599B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ~tartUnifiedTileModelCache.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 77a1839d96d88daa80d1f612377f73bd8bf1f28e45e4f257044783865ae271dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        microsoftwindows.client[1].xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RWN805R5\microsoftwindows.client[1].xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 97B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 35b889c0a4f6daaad9d5e29886e9ce6a07a18a05d1fd2d54417a14ba3e7870c7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        AppsIndex.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\AppsIndex.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0ccc198107d0539cebc830513b14b56674f89b4432ac2e2daec243d13728b724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        AppsIndex.db-shm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\AppsIndex.db-shm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b4cafa2b28e8ee3b7325e0c69fcc3ff871641eda1d257e0458f4513d48cfa66a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a72953cd2461ba0250cc8df2933036bab90d037df9098bfa353d1d106a5bb8fa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SearchUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 21e1406d456bbe5585f604f12e0b762f314feaa24f307544f8cccffdd26d7958
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SearchUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9be443053da2ad035eec1d4dbf814f8eccadebd66836fcb10b5aea1d44c0f399
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SettingsCache.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 575KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Pictures.library-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 946B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 976bd478030f5a2cfda905786ae7b506b23ef08ded0f288168d11cd3e18cb220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Pictures.library-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1484096efdb7dc3d64bf8f564d8d0daea6df24f9ee4f2135fe3c1962eddc0ff7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5f7b5f1e01b83767.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a72f9e27099e82f9bc20ba86bdcd1c3c3e78498446dc763016f48a439bd55f6b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6a1e62bd534bad1a3dd9d91dac875d223c5a739763006455d3e59bf605798ccc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TranscodedWallpaper
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 54KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c80777e1b2e6747cdeedb9497e81e42924d5f59840e1fea2d49653f4e69bf69e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Pictures\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 520B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Pictures\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 380B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 73671d1ba8a835e74033f7e62afb9371c98f01efdd760a2d7093abbfcab7fafa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 174B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6de1a716b5c49541ebc9692b16efa6fdb75b18c2a210974f94f83dcfdf8800d7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        !!!READ_ME_MEDUSA!!!.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\!!!READ_ME_MEDUSA!!!.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 35e2680fd2cf081f7e9ea24c3afb3ec725a004d4cc318b98a9530cce748b72de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-3047816590-610495838-277027736-1000\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 129B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6212-30011-0x00000000124E0000-0x0000000012823000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6212-30012-0x00000000177C0000-0x000000001803B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7320-29824-0x0000024E84830000-0x0000024E84850000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7320-29788-0x0000024E81A70000-0x0000024E81A90000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7320-29808-0x0000024E81CB0000-0x0000024E81CD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7320-29790-0x0000024E81E90000-0x0000024E81F90000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7320-29757-0x0000024E801E0000-0x0000024E802E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download