26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e192995a42b9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e192995a42b9…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da"],"about":{"@type":"SoftwareApplication","name":"scvhost.exe","applicationCategory":["peexe","executable"],"identifier":"e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6ee,"/c wevtutil cl Application" on 2018-4-15.00:52:02.125 "/c wevtutil cl security" on 2018-4-15.00:52:02.373 "/c wevtutil cl setup" on 2018-4-15.00:52:02.552 "/c wevtutil cl system" on 2018-4-15.00:52:02.690 "/c vssadmin.exe Delete Shadows \/All \/Quiet" on 2018-4-15.00:52:02.855 "/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" on 2018-4-15.00:52:03.007 "/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" on 2018-4-15.00:52:47.610 "/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" on 2018-4-15.00:53:32.241 "/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" on 2018-4-15.00:54:16.872 "/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" on 2018-4-15.00:55:01.503 "/c WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE" on 2018-4-15.00:55:46.148 "/c WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE" on 2018-4-15.00:56:30.779 "/c WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE" on 2018-4-15.00:57:15.424 "/c WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE" on 2018-4-15.00:58:00.041 "/c WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE" on 2018-4-15.00:58:44.686 "/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'" on 2018-4-15.00:59:29.317 "/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'" on 2018-4-15.01:00:13.934 "/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'" on 2018-4-15.01:00:58.565 "/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'" on 2018-4-15.01:01:43.196 "/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'" on 2018-4-15.01:02:27.81328:T924,Spawned process "cmd.exe" with commandline "/c wevtutil cl Application" (UID: 00014021-00002264) Spawned process "wevtutil.exe" with commandline "wevtutil cl Application" (UID: 00014027-00003836) Spawned process "cmd.exe" with commandline "/c wevtutil cl security" (UID: 00014040-00003736) Spawned process "wevtutil.exe" with commandline "wevtutil cl security" (UID: 00014047-00001824) Spawned process "cmd.exe" with commandline "/c wevtutil cl setup" (UID: 00014054-00003164) Spawned process "wevtutil.exe" with commandline "wevtutil cl setup" (UID: 00014058-00004056) Spawned process "cmd.exe" with commandline "/c wevtutil cl system" (UID: 00014065-00003092) Spawned process "wevtutil.exe" with commandline "wevtutil cl system" (UID: 00014068-00000528) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows \/All \/Quiet" (UID: 00014077-00002420) Spawned process "vssadmin.exe" with commandline "Delete Shadows \/All \/Quiet" (UID: 00014080-00000328) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" (UID: 00014088-00003256) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" (UID: 00014092-00002380) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" (UID: 00014421-00000352) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" (UID: 00014427-00002948) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" (UID: 00014757-00002152) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" (UID: 00014763-00001384) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" (UID: 00015093-00004900) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" (UID: 00015100-00004904) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" (UID: 00015429-00002648) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" (UID: 00015436-00004240)29:Ta8e,Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" (UID: 00014092-00002380) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" (UID: 00014427-00002948) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" (UID: 00014763-00001384) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" (UID: 00015100-00004904) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" (UID: 00015436-00004240) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE" (UID: 00015773-00003656) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE" (UID: 00016109-00001636) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE" (UID: 00016446-00001424) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE" (UID: 00016780-00004760) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE" (UID: 00017118-00002204) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'" (UID: 00017453-00004316) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00017789-00002640) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00018125-00002540) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'" (UID: 00018461-00005056) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'" (UID: 00018795-00003924) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL ChangeStartMode 'Disabled'" (UID: 00019131-00003424) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL ChangeStartMode 'Disabled'" (UID: 00019467-00004092) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL ChangeStartMode 'Disabled'" (UID: 00019804-00003976) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'CALL ChangeStartMode 'Disabled'" (UID: 00020140-00003344) Process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL ChangeStartMode 'Disabled'" (UID: 00020476-00003036)2a:T400,"" at 00013885-00003048-00000033-61269932 "WMIC.exe" at 00014092-00002380-00000033-61661194 "WMIC.exe" at 00014427-00002948-00000033-63150308 "WMIC.exe" at 00014763-00001384-00000033-64598738 "WMIC.exe" at 00015100-00004904-00000033-66111997 "WMIC.exe" at 00015436-00004240-00000033-67570237 "WMIC.exe" at 00015773-00003656-00000033-69077650 "WMIC.exe" at 00016109-00001636-00000033-70534272 "WMIC.exe" at 00016446-00001424-00000033-72032392 "WMIC.exe" at 00016780-00004760-00000033-73463937 "WMIC.exe" at 00017118-00002204-00000033-74973401 "WMIC.exe" at 00017453-00004316-00000033-76404242 "WMIC.exe" at 00017789-00002640-00000033-77872543 "WMIC.exe" at 00018125-00002540-00000033-79287309 "WMIC.exe" at 00018461-00005056-00000033-80789257 "WMIC.exe" at 00018795-00003924-00000033-82234020 "WMIC.exe" at 00019131-00003424-00000033-83739425 "WMIC.exe" at 00019467-00004092-00000033-85187163 "WMIC.exe" at 00019804-00003976-00000033-86691119 "WMIC.exe" at 00020140-00003344-00000033-881383452b:T470,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\wevtutil.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\wevtutil.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\wevtutil.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\wevtutil.exe" (Handle: 124) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\vssadmin.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\vssadmin.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\vssadmin.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\vssadmin.exe" (Handle: 124) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\wbem\WMIC.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\wbem\WMIC.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\wbem\WMIC.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\wbem\WMIC.exe" (Handle: 124)2c:T1bfa,Spawned process "" (UID: 00013885-00003048) Spawned process "cmd.exe" with commandline "/c wevtutil cl Application" (UID: 00014021-00002264) Spawned process "wevtutil.exe" with commandline "wevtutil cl Application" (UID: 00014027-00003836) Spawned process "cmd.exe" with commandline "/c wevtutil cl security" (UID: 00014040-00003736) Spawned process "wevtutil.exe" with commandline "wevtutil cl security" (UID: 00014047-00001824) Spawned process "cmd.exe" with commandline "/c wevtutil cl setup" (UID: 00014054-00003164) Spawned process "wevtutil.exe" with commandline "wevtutil cl setup" (UID: 00014058-00004056) Spawned process "cmd.exe" with commandline "/c wevtutil cl system" (UID: 00014065-00003092) Spawned process "wevtutil.exe" with commandline "wevtutil cl system" (UID: 00014068-00000528) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows \/All \/Quiet" (UID: 00014077-00002420) Spawned process "vssadmin.exe" with commandline "Delete Shadows \/All \/Quiet" (UID: 00014080-00000328) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" (UID: 00014088-00003256) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE" (UID: 00014092-00002380) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" (UID: 00014421-00000352) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE" (UID: 00014427-00002948) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" (UID: 00014757-00002152) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE" (UID: 00014763-00001384) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" (UID: 00015093-00004900) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE" (UID: 00015100-00004904) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" (UID: 00015429-00002648) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE" (UID: 00015436-00004240) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE" (UID: 00015766-00003536) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE" (UID: 00015773-00003656) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE" (UID: 00016102-00004944) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE" (UID: 00016109-00001636) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE" (UID: 00016439-00003948) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE" (UID: 00016446-00001424) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE" (UID: 00016775-00004960) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE" (UID: 00016780-00004760) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE" (UID: 00017111-00003384) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE" (UID: 00017118-00002204) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'" (UID: 00017447-00003444) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'" (UID: 00017453-00004316) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00017783-00004328) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00017789-00002640) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00018118-00005012) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'" (UID: 00018125-00002540) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'" (UID: 00018454-00005104) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'" (UID: 00018461-00005056) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'" (UID: 00018790-00002396) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'" (UID: 00018795-00003924) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL ChangeStartMode 'Disabled'" (UID: 00019124-00002560) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL ChangeStartMode 'Disabled'" (UID: 00019131-00003424) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL ChangeStartMode 'Disabled'" (UID: 00019460-00002400) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL ChangeStartMode 'Disabled'" (UID: 00019467-00004092) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL ChangeStartMode 'Disabled'" (UID: 00019797-00002744) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL ChangeStartMode 'Disabled'" (UID: 00019804-00003976) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'CALL ChangeStartMode 'Disabled'" (UID: 00020133-00002608) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'CALL ChangeStartMode 'Disabled'" (UID: 00020140-00003344) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL ChangeStartMode 'Disabled'" (UID: 00020469-00002496) Spawned process "WMIC.exe" with commandline "WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL ChangeStartMode 'Disabled'" (UID: 00020476-00003036) Spawned process "cmd.exe" with commandline "/c sc config FirebirdServerDefaultInstance start= disabled" (UID: 00020805-00003124) Spawned process "sc.exe" with commandline "sc config FirebirdServerDefaultInstance start= disabled" (UID: 00020811-00002368) Spawned process "cmd.exe" with commandline "/c taskkill \/IM fb_inet_server.exe \/F" (UID: 00020817-00002992)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791079541292,"unified_at":"2026-10-04T02:05:41.292Z","metadata":{"hashes":{"sha256":"e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da","sha1":"2f79c3857138e53e96a01cc87d3c10fd61469296","md5":"26450fd3595154e4e7934f74e8802879","sha512":"f2d899fbe005c6d556956d08706e5ddcc63e87e0b0b9d8fd365c1e9bc72068d016de9f39e3af72a38f08ee0c35f48d2f6936e519a65576fdc21c79abee5e09df","ssdeep":"24576:DddaKnk/Ay5zJW6Z38qHeBAfbeYaalu5DEo00ve2ClP:DQ59QqHz5afve2Y","ssdeep_chunks":["24576:DddaKnk","24576:ddaKnk/","24576:daKnk/A","24576:aKnk/Ay","24576:Knk/Ay5","24576:nk/Ay5z","24576:k/Ay5zJ","24576:/Ay5zJW","24576:Ay5zJW6","24576:y5zJW6Z","24576:5zJW6Z3","24576:zJW6Z38","24576:JW6Z38q","24576:W6Z38qH","24576:6Z38qHe","24576:Z38qHeB","24576:38qHeBA","24576:8qHeBAf","24576:qHeBAfb","24576:HeBAfbe","24576:eBAfbeY","24576:BAfbeYa","24576:AfbeYaa","24576:fbeYaal","24576:beYaalu","24576:eYaalu5","24576:Yaalu5D","24576:aalu5DE","24576:alu5DEo","24576:lu5DEo0","24576:u5DEo00","24576:5DEo00v","24576:DEo00ve","24576:Eo00ve2","24576:o00ve2C","24576:00ve2Cl","24576:0ve2ClP","49152:DddaKnk","49152:ddaKnk/","49152:daKnk/A","49152:aKnk/Ay","49152:Knk/Ay5","49152:nk/Ay5z","49152:k/Ay5zJ","49152:/Ay5zJW","49152:Ay5zJW6","49152:y5zJW6Z","49152:5zJW6Z3","49152:zJW6Z38","49152:JW6Z38q","49152:W6Z38qH","49152:6Z38qHe","49152:Z38qHeB","49152:38qHeBA","49152:8qHeBAf","49152:qHeBAfb","49152:HeBAfbe","49152:eBAfbeY","49152:BAfbeYa","49152:AfbeYaa","49152:fbeYaal","49152:beYaalu","49152:eYaalu5","49152:Yaalu5D","49152:aalu5DE","49152:alu5DEo","49152:lu5DEo0","49152:u5DEo00","49152:5DEo00v","49152:DEo00ve","49152:Eo00ve2","49152:o00ve2C","49152:00ve2Cl","49152:0ve2ClP","24576:DQ59QqH","24576:Q59QqHz","24576:59QqHz5","24576:9QqHz5a","24576:QqHz5af","24576:qHz5afv","24576:Hz5afve","24576:z5afve2","24576:5afve2Y"],"imphash":"ae421b5e8022a2b8ec8becba4cc664ad"},"file_info":{"file_name":"scvhost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1549312,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523749867000,"last_seen":1665267926000,"last_multi_scan":1665267926000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","crypt","downloader","filecryptor","haknata","lamin","maxdriver","miner","neshta","ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":11,"malicious_count":3,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Xpan.tps4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1232178","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.XRatLocker.5E892A47","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.XRatLocker.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.IS.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.XRatLocker.5E892A47 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.XRatLocker.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Xratlocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00500c371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Xpan.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FNIX!26450FD35951","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.enxprt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Haknata.S1240226","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ransom-FI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Deshacop.1549312","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.F4FB4B79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.F4FB4B79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoNM4.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Xpan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"malicious","threat_name":"Hacktool.Crypter.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 61157-53-004014C0\n SetUnhandledExceptionFilter@KERNEL32.dll at 61157-12632-00412490\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013885-00003048-5840-1-004014C0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013885-00003048-5840-12489-00412490","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 61157-13519-00428EC0\n GetSystemTimeAsFileTime@KERNEL32.dll at 61157-12057-00428E20\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013885-00003048-5840-937-004123E0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013885-00003048-5840-4866-00428E20\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013885-00003048-5840-13410-00428EC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wevtutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"net1.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"net1.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$27","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ProPlusWW.xml.NMCRYPT\" has type \"data\"\n \"pkeyconfig-office.xrm-ms.NMCRYPT\" has type \"data\"\n \"OWOW32WW.cab.NMCRYPT\" has type \"data\"\n \"ProPsWW.cab.NMCRYPT\" has type \"data\"\n \"Office32WW.xml.NMCRYPT\" has type \"data\"\n \"ProPsWW2.cab.NMCRYPT\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\cmd.exe\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\wevtutil.exe\"\n \"wevtutil.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\wevtutil.exe.mui\"\n \"wevtutil.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://gcc.gnu.org/bugs.html\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")\n \"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"cmd.exe\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")\n \"wevtutil.exe\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")\n \"vssadmin.exe\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")\n \"WMIC.exe\" wrote bytes \"c0dfbc771cf9bb77ccf8bb770d64bd7700000000c011d67600000000fc3ed67600000000e013d676000000009457cb7625e0bc77c6e0bc7700000000bc6aca7600000000cf31d676000000009319cb76000000002c32d67600000000\" to virtual address \"0x75601000\" (part of module \"NSI.DLL\")\n \"WMIC.exe\" wrote bytes \"7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501\" to virtual address \"0x75E907E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wevtutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"$2a","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.61625074283","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"(DEFAULT)\"; Value: \"C:\\scvhost.exe supermetroidrules\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2b","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.7/32, 192.168.56.8/29, 192.168.56.16/32, 192.168.56.75/32, 192.168.56.76/30, 192.168.56.80/30, 192.168.56.84/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows \\/All \\/Quiet\" (UID: 00014080-00000328)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"scvhost.exe.bin\" claimed CRC 1572204 while the actual is CRC 1594588","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n CryptEncrypt\n RegOpenKeyExW\n CreateServiceW\n GetUserNameW\n RegDeleteValueW\n StartServiceW\n LoadLibraryA\n GetModuleFileNameW\n IsDebuggerPresent\n GetTickCount\n OutputDebugStringA\n GetFileAttributesW\n GetFileSizeEx\n LockResource\n UnhandledExceptionFilter\n VirtualProtect\n DeleteFileW\n GetProcAddress\n GetThreadContext\n GetTempFileNameW\n GetComputerNameW\n WriteFile\n GetModuleHandleA\n FindNextFileW\n GetTempPathW\n GetStartupInfoA\n FindFirstFileW\n GetModuleHandleW\n TerminateProcess\n CreateProcessA\n FindResourceW\n CreateFileW\n Sleep\n ShellExecuteW\n socket\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2c","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/66 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/66 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.1/32, 192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/28, 192.168.56.32/27, 192.168.56.64/26, 192.168.56.128/28, 192.168.56.144/30, 192.168.56.148/31, 192.168.56.150/32, 192.168.56.152/29, 192.168.56.160/27, 192.168.56.192/27, 192.168.56.224/28, 192.168.56.240/29, 192.168.56.248/30, 192.168.56.252/31, 192.168.56.254/32\"","origin":"Network Traffic","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]}]},"activity":{"stats":{"process_count":192,"spawned_processes_count":192,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":24,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["coinminer","crypt","downloader","filecryptor","haknata","lamin","maxdriver","miner","neshta","ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5ad293ea7ca3e13174072ae3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.XRatLocker","submit_name":"scvhost.exe","analysis_start_time":"2018-04-15T00:50:14+00:00","indicators_count":{"informative":16,"suspicious":17,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}],"processes":[{"pid":3048,"ppid":0,"name":"scvhost.exe","command_line":"","sha256":"e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da","normalized_path":"C:\\scvhost.exe","uid":"00013885-00003048","icon":"$2d"},{"pid":2264,"ppid":3048,"name":"cmd.exe","command_line":"/c wevtutil cl Application","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014021-00002264"},{"pid":3836,"ppid":2264,"name":"wevtutil.exe","command_line":"wevtutil cl Application","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\SysWOW64\\wevtutil.exe","parent_uid":"00014021-00002264","uid":"00014027-00003836"},{"pid":3736,"ppid":3048,"name":"cmd.exe","command_line":"/c wevtutil cl security","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014040-00003736"},{"pid":1824,"ppid":3736,"name":"wevtutil.exe","command_line":"wevtutil cl security","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\SysWOW64\\wevtutil.exe","parent_uid":"00014040-00003736","uid":"00014047-00001824"},{"pid":3164,"ppid":3048,"name":"cmd.exe","command_line":"/c wevtutil cl setup","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014054-00003164"},{"pid":4056,"ppid":3164,"name":"wevtutil.exe","command_line":"wevtutil cl setup","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\SysWOW64\\wevtutil.exe","parent_uid":"00014054-00003164","uid":"00014058-00004056"},{"pid":3092,"ppid":3048,"name":"cmd.exe","command_line":"/c wevtutil cl system","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014065-00003092"},{"pid":528,"ppid":3092,"name":"wevtutil.exe","command_line":"wevtutil cl system","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\SysWOW64\\wevtutil.exe","parent_uid":"00014065-00003092","uid":"00014068-00000528"},{"pid":2420,"ppid":3048,"name":"cmd.exe","command_line":"/c vssadmin.exe Delete Shadows \\/All \\/Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014077-00002420"},{"pid":328,"ppid":2420,"name":"vssadmin.exe","command_line":"Delete Shadows \\/All \\/Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00014077-00002420","uid":"00014080-00000328"},{"pid":3256,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014088-00003256"},{"pid":2380,"ppid":3256,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00014088-00003256","uid":"00014092-00002380"},{"pid":352,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014421-00000352"},{"pid":2948,"ppid":352,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00014421-00000352","uid":"00014427-00002948"},{"pid":2152,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00014757-00002152"},{"pid":1384,"ppid":2152,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00014757-00002152","uid":"00014763-00001384"},{"pid":4900,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00015093-00004900"},{"pid":4904,"ppid":4900,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00015093-00004900","uid":"00015100-00004904"},{"pid":2648,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00015429-00002648"},{"pid":4240,"ppid":2648,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00015429-00002648","uid":"00015436-00004240"},{"pid":3536,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00015766-00003536"},{"pid":3656,"ppid":3536,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00015766-00003536","uid":"00015773-00003656"},{"pid":4944,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00016102-00004944"},{"pid":1636,"ppid":4944,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00016102-00004944","uid":"00016109-00001636"},{"pid":3948,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00016439-00003948"},{"pid":1424,"ppid":3948,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00016439-00003948","uid":"00016446-00001424"},{"pid":4960,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00016775-00004960"},{"pid":4760,"ppid":4960,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00016775-00004960","uid":"00016780-00004760"},{"pid":3384,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00017111-00003384"},{"pid":2204,"ppid":3384,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00017111-00003384","uid":"00017118-00002204"},{"pid":3444,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00017447-00003444"},{"pid":4316,"ppid":3444,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%Firebird%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00017447-00003444","uid":"00017453-00004316"},{"pid":4328,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00017783-00004328"},{"pid":2640,"ppid":4328,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%MSSQL%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00017783-00004328","uid":"00017789-00002640"},{"pid":5012,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00018118-00005012"},{"pid":2540,"ppid":5012,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SQL%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00018118-00005012","uid":"00018125-00002540"},{"pid":5104,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00018454-00005104"},{"pid":5056,"ppid":5104,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%Exchange%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00018454-00005104","uid":"00018461-00005056"},{"pid":2396,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00018790-00002396"},{"pid":3924,"ppid":2396,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%wsbex%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00018790-00002396","uid":"00018795-00003924"},{"pid":2560,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00019124-00002560"},{"pid":3424,"ppid":2560,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%postgresql%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00019124-00002560","uid":"00019131-00003424"},{"pid":2400,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00019460-00002400"},{"pid":4092,"ppid":2400,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%BACKP%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00019460-00002400","uid":"00019467-00004092"},{"pid":2744,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00019797-00002744"},{"pid":3976,"ppid":2744,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%tomcat%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00019797-00002744","uid":"00019804-00003976"},{"pid":2608,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020133-00002608"},{"pid":3344,"ppid":2608,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SharePoint%'CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00020133-00002608","uid":"00020140-00003344"},{"pid":2496,"ppid":3048,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL ChangeStartMode 'Disabled'","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020469-00002496"},{"pid":3036,"ppid":2496,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE 'caption LIKE '%SBS%'' CALL ChangeStartMode 'Disabled'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00020469-00002496","uid":"00020476-00003036"},{"pid":3124,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config FirebirdServerDefaultInstance start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020805-00003124"},{"pid":2368,"ppid":3124,"name":"sc.exe","command_line":"sc config FirebirdServerDefaultInstance start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020805-00003124","uid":"00020811-00002368"},{"pid":2992,"ppid":3048,"name":"cmd.exe","command_line":"/c taskkill \\/IM fb_inet_server.exe \\/F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020817-00002992"},{"pid":432,"ppid":2992,"name":"taskkill.exe","command_line":"taskkill \\/IM fb_inet_server.exe \\/F","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00020817-00002992","uid":"00020821-00000432"},{"pid":2632,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop FirebirdServerDefaultInstance","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020833-00002632"},{"pid":2180,"ppid":2632,"name":"net.exe","command_line":"net stop FirebirdServerDefaultInstance","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00020833-00002632","uid":"00020836-00002180"},{"pid":3772,"ppid":2180,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop FirebirdServerDefaultInstance","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00020836-00002180","uid":"00020843-00003772"},{"pid":1404,"ppid":3048,"name":"cmd.exe","command_line":"/c taskkill \\/IM sqlservr.exe \\/F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020852-00001404"},{"pid":3824,"ppid":1404,"name":"taskkill.exe","command_line":"taskkill \\/IM sqlservr.exe \\/F","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00020852-00001404","uid":"00020856-00003824"},{"pid":4116,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSSQLSERVER start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020865-00004116"},{"pid":4736,"ppid":4116,"name":"sc.exe","command_line":"sc config MSSQLSERVER start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020865-00004116","uid":"00020869-00004736"},{"pid":4740,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSSQL$SQLEXPRESS start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020874-00004740"},{"pid":3584,"ppid":4740,"name":"sc.exe","command_line":"sc config MSSQL$SQLEXPRESS start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020874-00004740","uid":"00020877-00003584"},{"pid":4208,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSSQLSERVER","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020883-00004208"},{"pid":972,"ppid":4208,"name":"net.exe","command_line":"net stop MSSQLSERVER","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00020883-00004208","uid":"00020886-00000972"},{"pid":3008,"ppid":972,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSSQLSERVER","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00020886-00000972","uid":"00020890-00003008"},{"pid":2056,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSSQL$SQLEXPRESS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020897-00002056"},{"pid":3004,"ppid":2056,"name":"net.exe","command_line":"net stop MSSQL$SQLEXPRESS","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00020897-00002056","uid":"00020900-00003004"},{"pid":3028,"ppid":3004,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSSQL$SQLEXPRESS","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00020900-00003004","uid":"00020904-00003028"},{"pid":2224,"ppid":3048,"name":"cmd.exe","command_line":"/c taskkill \\/IM pg_ctl.exe \\/F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020911-00002224"},{"pid":2340,"ppid":2224,"name":"taskkill.exe","command_line":"taskkill \\/IM pg_ctl.exe \\/F","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00020911-00002224","uid":"00020915-00002340"},{"pid":2620,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config postgresql-9.0 start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020924-00002620"},{"pid":4908,"ppid":2620,"name":"sc.exe","command_line":"sc config postgresql-9.0 start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020924-00002620","uid":"00020927-00004908"},{"pid":2212,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop postgresql-9.0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020931-00002212"},{"pid":2280,"ppid":2212,"name":"net.exe","command_line":"net stop postgresql-9.0","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00020931-00002212","uid":"00020934-00002280"},{"pid":3104,"ppid":2280,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop postgresql-9.0","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00020934-00002280","uid":"00020938-00003104"},{"pid":2000,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeAB start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020945-00002000"},{"pid":1152,"ppid":2000,"name":"sc.exe","command_line":"sc config MSExchangeAB start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020945-00002000","uid":"00020950-00001152"},{"pid":4612,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeAntispamUpdate start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020955-00004612"},{"pid":848,"ppid":4612,"name":"sc.exe","command_line":"sc config MSExchangeAntispamUpdate start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020955-00004612","uid":"00020957-00000848"},{"pid":4600,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeEdgeSync start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020962-00004600"},{"pid":4400,"ppid":4600,"name":"sc.exe","command_line":"sc config MSExchangeEdgeSync start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020962-00004600","uid":"00020965-00004400"},{"pid":4492,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeFDS start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020969-00004492"},{"pid":4500,"ppid":4492,"name":"sc.exe","command_line":"sc config MSExchangeFDS start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020969-00004492","uid":"00020972-00004500"},{"pid":4468,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeFBA start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020976-00004468"},{"pid":4484,"ppid":4468,"name":"sc.exe","command_line":"sc config MSExchangeFBA start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020976-00004468","uid":"00020979-00004484"},{"pid":4756,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeImap4 start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020984-00004756"},{"pid":4816,"ppid":4756,"name":"sc.exe","command_line":"sc config MSExchangeImap4 start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020984-00004756","uid":"00020987-00004816"},{"pid":4376,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeIS start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00020991-00004376"},{"pid":4636,"ppid":4376,"name":"sc.exe","command_line":"sc config MSExchangeIS start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00020991-00004376","uid":"00020995-00004636"},{"pid":4620,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeMailSubmission start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021000-00004620"},{"pid":4384,"ppid":4620,"name":"sc.exe","command_line":"sc config MSExchangeMailSubmission start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021000-00004620","uid":"00021003-00004384"},{"pid":1000,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeMailboxAssistants start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021008-00001000"},{"pid":2452,"ppid":1000,"name":"sc.exe","command_line":"sc config MSExchangeMailboxAssistants start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021008-00001000","uid":"00021011-00002452"},{"pid":4268,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeMailboxReplication start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021015-00004268"},{"pid":2656,"ppid":4268,"name":"sc.exe","command_line":"sc config MSExchangeMailboxReplication start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021015-00004268","uid":"00021021-00002656"},{"pid":1848,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeMonitoring start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021025-00001848"},{"pid":3408,"ppid":1848,"name":"sc.exe","command_line":"sc config MSExchangeMonitoring start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021025-00001848","uid":"00021028-00003408"},{"pid":1944,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangePop3 start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021033-00001944"},{"pid":1916,"ppid":1944,"name":"sc.exe","command_line":"sc config MSExchangePop3 start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021033-00001944","uid":"00021036-00001916"},{"pid":1912,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeProtectedServiceHost start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021040-00001912"},{"pid":1092,"ppid":1912,"name":"sc.exe","command_line":"sc config MSExchangeProtectedServiceHost start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021040-00001912","uid":"00021043-00001092"},{"pid":3392,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeRepl start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021047-00003392"},{"pid":4112,"ppid":3392,"name":"sc.exe","command_line":"sc config MSExchangeRepl start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021047-00003392","uid":"00021050-00004112"},{"pid":3848,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeRPC start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021055-00003848"},{"pid":2148,"ppid":3848,"name":"sc.exe","command_line":"sc config MSExchangeRPC start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021055-00003848","uid":"00021058-00002148"},{"pid":4076,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeSearch start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021062-00004076"},{"pid":4648,"ppid":4076,"name":"sc.exe","command_line":"sc config MSExchangeSearch start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021062-00004076","uid":"00021067-00004648"},{"pid":2800,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config wsbexchange start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021071-00002800"},{"pid":4568,"ppid":2800,"name":"sc.exe","command_line":"sc config wsbexchange start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021071-00002800","uid":"00021074-00004568"},{"pid":1164,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeServiceHost start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021079-00001164"},{"pid":4364,"ppid":1164,"name":"sc.exe","command_line":"sc config MSExchangeServiceHost start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021079-00001164","uid":"00021081-00004364"},{"pid":844,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeSA start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021089-00000844"},{"pid":2844,"ppid":844,"name":"sc.exe","command_line":"sc config MSExchangeSA start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021089-00000844","uid":"00021092-00002844"},{"pid":3768,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeThrottling start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021096-00003768"},{"pid":3588,"ppid":3768,"name":"sc.exe","command_line":"sc config MSExchangeThrottling start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021096-00003768","uid":"00021100-00003588"},{"pid":3172,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeTransport start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021104-00003172"},{"pid":4048,"ppid":3172,"name":"sc.exe","command_line":"sc config MSExchangeTransport start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021104-00003172","uid":"00021107-00004048"},{"pid":2820,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeTransportLogSearch start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021112-00002820"},{"pid":4164,"ppid":2820,"name":"sc.exe","command_line":"sc config MSExchangeTransportLogSearch start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021112-00002820","uid":"00021115-00004164"},{"pid":4028,"ppid":3048,"name":"cmd.exe","command_line":"/c sc config MSExchangeADTopology start= disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021120-00004028"},{"pid":4564,"ppid":4028,"name":"sc.exe","command_line":"sc config MSExchangeADTopology start= disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00021120-00004028","uid":"00021124-00004564"},{"pid":3608,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeAB","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021129-00003608"},{"pid":3576,"ppid":3608,"name":"net.exe","command_line":"net stop MSExchangeAB","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021129-00003608","uid":"00021133-00003576"},{"pid":4188,"ppid":3576,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeAB","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021133-00003576","uid":"00021137-00004188"},{"pid":1656,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeAntispamUpdate","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021144-00001656"},{"pid":2712,"ppid":1656,"name":"net.exe","command_line":"net stop MSExchangeAntispamUpdate","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021144-00001656","uid":"00021147-00002712"},{"pid":2736,"ppid":2712,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeAntispamUpdate","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021147-00002712","uid":"00021152-00002736"},{"pid":2536,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeEdgeSync","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021162-00002536"},{"pid":2984,"ppid":2536,"name":"net.exe","command_line":"net stop MSExchangeEdgeSync","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021162-00002536","uid":"00021165-00002984"},{"pid":520,"ppid":2984,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeEdgeSync","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021165-00002984","uid":"00021169-00000520"},{"pid":2516,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeFDS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021176-00002516"},{"pid":4864,"ppid":2516,"name":"net.exe","command_line":"net stop MSExchangeFDS","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021176-00002516","uid":"00021179-00004864"},{"pid":1444,"ppid":4864,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeFDS","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021179-00004864","uid":"00021183-00001444"},{"pid":2392,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeFBA","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021190-00002392"},{"pid":4280,"ppid":2392,"name":"net.exe","command_line":"net stop MSExchangeFBA","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021190-00002392","uid":"00021193-00004280"},{"pid":4276,"ppid":4280,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeFBA","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021193-00004280","uid":"00021217-00004276"},{"pid":4100,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeImap4","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021232-00004100"},{"pid":2932,"ppid":4100,"name":"net.exe","command_line":"net stop MSExchangeImap4","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021232-00004100","uid":"00021235-00002932"},{"pid":4772,"ppid":2932,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeImap4","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021235-00002932","uid":"00021239-00004772"},{"pid":3136,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeIS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021246-00003136"},{"pid":1576,"ppid":3136,"name":"net.exe","command_line":"net stop MSExchangeIS","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021246-00003136","uid":"00021249-00001576"},{"pid":4260,"ppid":1576,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeIS","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021249-00001576","uid":"00021255-00004260"},{"pid":2036,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeMailSubmission","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021263-00002036"},{"pid":3328,"ppid":2036,"name":"net.exe","command_line":"net stop MSExchangeMailSubmission","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021263-00002036","uid":"00021267-00003328"},{"pid":4264,"ppid":3328,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeMailSubmission","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021267-00003328","uid":"00021271-00004264"},{"pid":2060,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeMailboxAssistants","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021278-00002060"},{"pid":4252,"ppid":2060,"name":"net.exe","command_line":"net stop MSExchangeMailboxAssistants","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021278-00002060","uid":"00021281-00004252"},{"pid":4036,"ppid":4252,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeMailboxAssistants","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021281-00004252","uid":"00021286-00004036"},{"pid":3668,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeMailboxReplication","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021293-00003668"},{"pid":4912,"ppid":3668,"name":"net.exe","command_line":"net stop MSExchangeMailboxReplication","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021293-00003668","uid":"00021298-00004912"},{"pid":3116,"ppid":4912,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeMailboxReplication","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021298-00004912","uid":"00021303-00003116"},{"pid":3792,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeMonitoring","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021309-00003792"},{"pid":3724,"ppid":3792,"name":"net.exe","command_line":"net stop MSExchangeMonitoring","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021309-00003792","uid":"00021312-00003724"},{"pid":2504,"ppid":3724,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeMonitoring","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021312-00003724","uid":"00021317-00002504"},{"pid":3304,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangePop3","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021324-00003304"},{"pid":1700,"ppid":3304,"name":"net.exe","command_line":"net stop MSExchangePop3","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021324-00003304","uid":"00021327-00001700"},{"pid":4940,"ppid":1700,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangePop3","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021327-00001700","uid":"00021332-00004940"},{"pid":1124,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeProtectedServiceHost","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021338-00001124"},{"pid":3388,"ppid":1124,"name":"net.exe","command_line":"net stop MSExchangeProtectedServiceHost","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021338-00001124","uid":"00021341-00003388"},{"pid":3352,"ppid":3388,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeProtectedServiceHost","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021341-00003388","uid":"00021346-00003352"},{"pid":4236,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeRepl","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021353-00004236"},{"pid":2124,"ppid":4236,"name":"net.exe","command_line":"net stop MSExchangeRepl","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021353-00004236","uid":"00021356-00002124"},{"pid":1396,"ppid":2124,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeRepl","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021356-00002124","uid":"00021360-00001396"},{"pid":4044,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeRPC","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021369-00004044"},{"pid":2128,"ppid":4044,"name":"net.exe","command_line":"net stop MSExchangeRPC","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021369-00004044","uid":"00021372-00002128"},{"pid":172,"ppid":2128,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeRPC","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021372-00002128","uid":"00021376-00000172"},{"pid":3888,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeSearch","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021385-00003888"},{"pid":2924,"ppid":3888,"name":"net.exe","command_line":"net stop MSExchangeSearch","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021385-00003888","uid":"00021388-00002924"},{"pid":4216,"ppid":2924,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeSearch","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021388-00002924","uid":"00021393-00004216"},{"pid":3616,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop wsbexchange","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021399-00003616"},{"pid":3052,"ppid":3616,"name":"net.exe","command_line":"net stop wsbexchange","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021399-00003616","uid":"00021403-00003052"},{"pid":4956,"ppid":3052,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop wsbexchange","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021403-00003052","uid":"00021407-00004956"},{"pid":2920,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeServiceHost","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021414-00002920"},{"pid":2836,"ppid":2920,"name":"net.exe","command_line":"net stop MSExchangeServiceHost","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021414-00002920","uid":"00021417-00002836"},{"pid":4776,"ppid":2836,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeServiceHost","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021417-00002836","uid":"00021421-00004776"},{"pid":3912,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeSA","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021428-00003912"},{"pid":3940,"ppid":3912,"name":"net.exe","command_line":"net stop MSExchangeSA","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021428-00003912","uid":"00021434-00003940"},{"pid":2704,"ppid":3940,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeSA","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021434-00003940","uid":"00021438-00002704"},{"pid":340,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeThrottling","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021445-00000340"},{"pid":3492,"ppid":340,"name":"net.exe","command_line":"net stop MSExchangeThrottling","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021445-00000340","uid":"00021448-00003492"},{"pid":3432,"ppid":3492,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeThrottling","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021448-00003492","uid":"00021452-00003432"},{"pid":2664,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeTransport","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021459-00002664"},{"pid":3404,"ppid":2664,"name":"net.exe","command_line":"net stop MSExchangeTransport","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021459-00002664","uid":"00021462-00003404"},{"pid":2912,"ppid":3404,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeTransport","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021462-00003404","uid":"00021466-00002912"},{"pid":3904,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeTransportLogSearch","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021473-00003904"},{"pid":3516,"ppid":3904,"name":"net.exe","command_line":"net stop MSExchangeTransportLogSearch","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021473-00003904","uid":"00021476-00003516"},{"pid":4992,"ppid":3516,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeTransportLogSearch","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021476-00003516","uid":"00021481-00004992"},{"pid":344,"ppid":3048,"name":"cmd.exe","command_line":"/c net stop MSExchangeADTopology\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013885-00003048","uid":"00021487-00000344"},{"pid":1016,"ppid":344,"name":"net.exe","command_line":"net stop MSExchangeADTopology\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00021487-00000344","uid":"00021490-00001016"},{"pid":2096,"ppid":1016,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSExchangeADTopology\"","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00021490-00001016","uid":"00021495-00002096"}],"all_imported_dlls":["browcli.dll","msvcrt.dll","cscapi.dll","wininet.dll","cryptbase.dll","gdi32.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","logoncli.dll","samlib.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","kernel32.dll","rpcrt4.dll","lpk.dll","ws2_32.dll","apphelp.dll","vssapi.dll","RpcRtRemote.dll","imm32.dll","winnsi.dll","credui.dll","bcrypt.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","version.dll","msvcr90.dll","samcli.dll","wow64.dll","usp10.dll","cryptsp.dll","wbemcomn.dll","normaliz.dll","uxtheme.dll","MSOXMLMF.DLL","advapi32.dll","wevtapi.dll","profapi.dll","wbemsvc.dll","dbghelp.dll","mpr.dll","ole32.dll","netmsg.dll","secur32.dll","clbcatq.dll","fastprox.dll","wow64cpu.dll","user32.dll","KernelBase.dll","srvcli.dll","mswsock.dll","vsstrace.dll","vbscript.dll","winsta.dll","dhcpcsvc.dll","WSHTCPIP.DLL","atl.dll","wtsapi32.dll","msxml3.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wow64win.dll","sechost.dll","sspicli.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","IPHLPAPI.DLL","shell32.dll","shlwapi.dll","msctf.dll","msxml3r.dll","iertutil.dll","netutils.dll","framedynos.dll","api-ms-win-downlevel-version-l1-1-0.dll","ntdsapi.dll","wmiutils.dll","dsrole.dll","netapi32.dll","comctl32.dll","wbemprox.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sxs.dll","nsi.dll","wkscli.dll","rsaenh.dll","winbrand.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ProPlusWW.xml.NMCRYPT","sha256":"0e7a765741d961e42080372543479442673bc923052ef93bcbe1fb6cb15b6193","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"pkeyconfig-office.xrm-ms.NMCRYPT","sha256":"75a0bd3a590c8bb3c21824529178457fcdb18a9936cf839cff5f2726c53eb645","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"OWOW32WW.cab.NMCRYPT","sha256":"db73bce192e15906cc13d4c2e1d25f2aa979ba43ab733bc1ddc0bd543ff12f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"ProPsWW.cab.NMCRYPT","sha256":"ecfe413b487b0601c9db9d72624652e0bde4bb532957f4f4b1c98b63aed5e24a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"Office32WW.xml.NMCRYPT","sha256":"094e234dc5ad0893f6cd25f54802cccdfb6d177e8f0473c376001a670884ea01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"name":"ProPsWW2.cab.NMCRYPT","sha256":"841215096d178a28a2dc51dc9361b9312155868b310afd4a14c7cdba985503c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wevtutil.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wevtutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\sc.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\net.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]},{"path":"%WINDIR%\\SysWOW64\\net1.exe","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5ad293ea7ca3e13174072ae3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5ad293ea7ca3e13174072ae3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample e192995a42b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e192995a42b9…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample e192995a42b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e192995a42b9…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e192995a42b91bd86aa0c5fe5d4e4aaff1b921bdb10946b1ea67565b5d3164da"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample e192995a42b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e192995a42b9…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]