Analysis
-
max time kernel
151s -
max time network
57s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win10v20210410
General
-
Target
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
-
Size
14KB
-
MD5
3355ace345e98406bdb331ccad568386
-
SHA1
81d5888bb8d43d88315c040be1f51db6bb5cf64c
-
SHA256
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178
-
SHA512
55223ee6f387252a401e62cd5b619afafcb3d63cb33cd1b9a12d782dadc9e68b95062363863f70f13eb28f751da710b78161f7efda464d66b1f98741e56f50e1
Malware Config
Extracted
C:\[HOW TO RECOVER FILES].TXT
prolock
support981723721@protonmail.com
http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion
Signatures
-
ProLock Ransomware
Rebranded update of PwndLocker first seen in March 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\InitializeStep.tif.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\InitializeStep.tif.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\InitializeStep.tif.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\RemoveStart.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\RemoveStart.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\DOCUME~1\Admin\Searches\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\Desktop\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\TABLET~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\TABLET~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\MLS6OOW4\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\AJ1NIV9I\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\RECORD~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\BQE06QBJ\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\DATASE~1\DESKTOP.INI dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\93PHUZFG\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SAVEDG~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\SAMPLE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Contacts\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\SendTo\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYPICT~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOWNLO~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Links\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\MLS6OOW4\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\93PHUZFG\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOWNLO~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\2MTLR0RV\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SendTo\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\VLFEZDK1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\USERPI~1\TaskBar\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Recent\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYVIDE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\FAVORI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\RECORD~1\SAMPLE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\XVLP3GFJ\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUBLIS~1\BACKGR~1\WB02085_.GIF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR7BC3~1.V20\META-INF\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0287408.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\DOCUME~1\THEMEF~1\Black Tie.xml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\ANTARC~1\Davis.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\TYPESU~1\Unicode\Mappings\win\CP1258.TXT.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\MEDIA\CAGCAT10\J0186002.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.EXCEL.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\PUBWZINT.REST.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0103850.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0313974.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PE00608_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BABY_01.MID.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BD19563_.GIF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\DOCUME~1\THEMEF~1\Flow.xml.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\7-Zip\Lang\kk.txt dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\DOCUME~1\MYVIDE~1\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0384862.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR43A2~1.V20\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0099195.GIF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\DOCUME~1\MYMUSI~1\SAMPLE~1\Sleep Away.mp3.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0382950.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\MEDIA\OFFICE14\BULLETS\BD21316_.GIF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\SO00728_.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\TN00255_.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\DOCUME~1\MYPICT~1\SAMPLE~1\Hydrangeas.jpg.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PSWAVY.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR9E15~1.V20\META-INF\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\1036\PPINTL.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\ENVELOPR.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PE00633_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\Hx_1033_MKWD_K.HxW dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile20.bmp.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Google\Chrome\APPLIC~1\890438~1.114\Locales\mr.pak.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\jre7\lib\zi\Asia\Manila.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0105414.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0145707.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\VERSION.txt dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0174952.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\NA02407_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Google\Chrome\APPLIC~1\890438~1.114\Locales\ja.pak dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\ORGECL~1.V20\feature.properties dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONGuide.onepkg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\GRINTL32.REST.trx_dll.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BS00200_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\NA01130_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUBLIS~1\BACKGR~1\WB02187_.GIF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0107154.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\1036\SGRES.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BL00194_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\Indiana\Tell_City dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\CG1606.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\COMPUT~1\computericon.jpg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GRA998~1\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\OUTLWVW.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 332 vssadmin.exe 1316 vssadmin.exe 948 vssadmin.exe 900 vssadmin.exe 1660 vssadmin.exe 276 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exepid process 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exepid process 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exevssvc.exedescription pid process Token: SeSecurityPrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeTakeOwnershipPrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeBackupPrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeRestorePrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeManageVolumePrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeDebugPrivilege 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeBackupPrivilege 1364 vssvc.exe Token: SeRestorePrivilege 1364 vssvc.exe Token: SeAuditPrivilege 1364 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1996 wrote to memory of 1900 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1900 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1900 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1900 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1900 wrote to memory of 1720 1900 net.exe net1.exe PID 1900 wrote to memory of 1720 1900 net.exe net1.exe PID 1900 wrote to memory of 1720 1900 net.exe net1.exe PID 1900 wrote to memory of 1720 1900 net.exe net1.exe PID 1996 wrote to memory of 1768 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1768 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1768 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1768 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1768 wrote to memory of 1660 1768 net.exe net1.exe PID 1768 wrote to memory of 1660 1768 net.exe net1.exe PID 1768 wrote to memory of 1660 1768 net.exe net1.exe PID 1768 wrote to memory of 1660 1768 net.exe net1.exe PID 1996 wrote to memory of 316 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 316 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 316 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 316 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 316 wrote to memory of 304 316 net.exe net1.exe PID 316 wrote to memory of 304 316 net.exe net1.exe PID 316 wrote to memory of 304 316 net.exe net1.exe PID 316 wrote to memory of 304 316 net.exe net1.exe PID 1996 wrote to memory of 524 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 524 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 524 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 524 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 524 wrote to memory of 1120 524 net.exe net1.exe PID 524 wrote to memory of 1120 524 net.exe net1.exe PID 524 wrote to memory of 1120 524 net.exe net1.exe PID 524 wrote to memory of 1120 524 net.exe net1.exe PID 1996 wrote to memory of 836 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 836 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 836 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 836 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1480 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1480 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1480 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1480 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1124 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1124 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1124 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 1124 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1480 wrote to memory of 396 1480 net.exe net1.exe PID 1480 wrote to memory of 396 1480 net.exe net1.exe PID 1480 wrote to memory of 396 1480 net.exe net1.exe PID 1480 wrote to memory of 396 1480 net.exe net1.exe PID 1124 wrote to memory of 1836 1124 net.exe net1.exe PID 1124 wrote to memory of 1836 1124 net.exe net1.exe PID 1124 wrote to memory of 1836 1124 net.exe net1.exe PID 1124 wrote to memory of 1836 1124 net.exe net1.exe PID 836 wrote to memory of 552 836 net.exe net1.exe PID 836 wrote to memory of 552 836 net.exe net1.exe PID 836 wrote to memory of 552 836 net.exe net1.exe PID 836 wrote to memory of 552 836 net.exe net1.exe PID 1996 wrote to memory of 828 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 828 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 828 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1996 wrote to memory of 828 1996 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 828 wrote to memory of 1492 828 net.exe net1.exe PID 828 wrote to memory of 1492 828 net.exe net1.exe PID 828 wrote to memory of 1492 828 net.exe net1.exe PID 828 wrote to memory of 1492 828 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "CSFalconService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "CSFalconService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeFramework" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Alerter" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alerter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "AcronisAgent" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "DFSR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DFSR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPIntegrationService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPIntegrationService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPProtectedService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPProtectedService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPSecurityService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPUpdateService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MB3Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MB3Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBAMService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeES" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeADTopology" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDelivery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeIS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRPC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRepl" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeServiceHost" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeTransport" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUMCR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MsDtsServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MySQL57" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OSearch15" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OSearch15" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OracleClientCache80" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "QuickBooksDB25" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPAdminV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPAdminV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPSearchHostController" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPSearchHostController" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPTraceV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPTraceV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPUserCodeV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPWriterV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPWriterV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBrowser" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackups" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackups" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSMQ" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSMQ" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLWriter" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackupAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SyncoveryVSSService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epag" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epag" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epredline" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epredline" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mozyprobackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "masvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "macmnsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mfemms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "psqlWGE" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "psqlWGE" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "swprv" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swprv" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wsbexchange" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wsbexchange" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "WinVNC4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WinVNC4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TMBMServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TMBMServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmccsf" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmccsf" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmlisten" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VSNAPVSS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VSNAPVSS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "stc_endpt_svc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wbengine" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "bbagent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bbagent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "NasPmService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NasPmService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "hasplms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "hasplms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlVss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlVss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlReqService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlReqService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RapidRecoveryAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "YTBackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "YTBackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "vhdsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "vhdsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TeamViewer" /y2⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TeamViewer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=unbounded2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-94-0x0000000000000000-mapping.dmp
-
memory/304-88-0x0000000000000000-mapping.dmp
-
memory/304-66-0x0000000000000000-mapping.dmp
-
memory/316-89-0x0000000000000000-mapping.dmp
-
memory/316-65-0x0000000000000000-mapping.dmp
-
memory/324-102-0x0000000000000000-mapping.dmp
-
memory/396-96-0x0000000000000000-mapping.dmp
-
memory/396-72-0x0000000000000000-mapping.dmp
-
memory/432-95-0x0000000000000000-mapping.dmp
-
memory/524-67-0x0000000000000000-mapping.dmp
-
memory/524-91-0x0000000000000000-mapping.dmp
-
memory/532-124-0x0000000000000000-mapping.dmp
-
memory/552-74-0x0000000000000000-mapping.dmp
-
memory/568-116-0x0000000000000000-mapping.dmp
-
memory/672-115-0x0000000000000000-mapping.dmp
-
memory/828-75-0x0000000000000000-mapping.dmp
-
memory/832-105-0x0000000000000000-mapping.dmp
-
memory/832-79-0x0000000000000000-mapping.dmp
-
memory/836-69-0x0000000000000000-mapping.dmp
-
memory/852-114-0x0000000000000000-mapping.dmp
-
memory/868-117-0x0000000000000000-mapping.dmp
-
memory/896-98-0x0000000000000000-mapping.dmp
-
memory/900-108-0x0000000000000000-mapping.dmp
-
memory/904-83-0x0000000000000000-mapping.dmp
-
memory/920-100-0x0000000000000000-mapping.dmp
-
memory/944-107-0x0000000000000000-mapping.dmp
-
memory/948-106-0x0000000000000000-mapping.dmp
-
memory/956-81-0x0000000000000000-mapping.dmp
-
memory/1004-123-0x0000000000000000-mapping.dmp
-
memory/1032-99-0x0000000000000000-mapping.dmp
-
memory/1100-101-0x0000000000000000-mapping.dmp
-
memory/1120-90-0x0000000000000000-mapping.dmp
-
memory/1120-68-0x0000000000000000-mapping.dmp
-
memory/1124-71-0x0000000000000000-mapping.dmp
-
memory/1124-121-0x0000000000000000-mapping.dmp
-
memory/1184-118-0x0000000000000000-mapping.dmp
-
memory/1196-120-0x0000000000000000-mapping.dmp
-
memory/1316-78-0x0000000000000000-mapping.dmp
-
memory/1480-70-0x0000000000000000-mapping.dmp
-
memory/1480-97-0x0000000000000000-mapping.dmp
-
memory/1484-119-0x0000000000000000-mapping.dmp
-
memory/1492-76-0x0000000000000000-mapping.dmp
-
memory/1556-112-0x0000000000000000-mapping.dmp
-
memory/1624-93-0x0000000000000000-mapping.dmp
-
memory/1628-92-0x0000000000000000-mapping.dmp
-
memory/1656-111-0x0000000000000000-mapping.dmp
-
memory/1660-86-0x0000000000000000-mapping.dmp
-
memory/1660-64-0x0000000000000000-mapping.dmp
-
memory/1676-80-0x0000000000000000-mapping.dmp
-
memory/1684-82-0x0000000000000000-mapping.dmp
-
memory/1720-84-0x0000000000000000-mapping.dmp
-
memory/1720-62-0x0000000000000000-mapping.dmp
-
memory/1744-85-0x0000000000000000-mapping.dmp
-
memory/1748-110-0x0000000000000000-mapping.dmp
-
memory/1760-113-0x0000000000000000-mapping.dmp
-
memory/1768-63-0x0000000000000000-mapping.dmp
-
memory/1768-87-0x0000000000000000-mapping.dmp
-
memory/1776-109-0x0000000000000000-mapping.dmp
-
memory/1812-103-0x0000000000000000-mapping.dmp
-
memory/1812-77-0x0000000000000000-mapping.dmp
-
memory/1824-122-0x0000000000000000-mapping.dmp
-
memory/1836-73-0x0000000000000000-mapping.dmp
-
memory/1900-61-0x0000000000000000-mapping.dmp
-
memory/1936-104-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB