prolock | 059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5

Analysis

max time kernel
151s
max time network
56s
platform
windows7_x64
resource
win7v20210410
submitted
26-07-2021 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Size

28KB
MD5

90cd7b4a952a6c929bd006f74125fb8c
SHA1

827e2e64857d77c18d26980a69ab54683ec6e7de
SHA256

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5
SHA512

3e8a6bf872900f8b2cdb395aa71ada4d7999e5e2f9717d5761c26fee41f8d686e8d171e210f2f4e2535eedcd9122e1e7ab5c31ead255c6950ed0f99d8b040a73

Score

10^/10

prolock ransomware spyware stealer

Malware Config

Extracted

Path

C:\[HOW TO RECOVER FILES].TXT

Family

prolock

Ransom Note

Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you have to pay the decryption fee in BTC. The final price depends on how fast you write to us. 1. Download TOR browser: https://www.torproject.org/ 2. Install the TOR Browser. 3. Open the TOR Browser. 4. Open our website in the TOR browser: msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion 5. Login using your ID D8756FE07320C1859F44 ***If you have any problems connecting or using TOR network: contact our support by email support981723721@protonmail.com [You'll receive instructions and price inside] The decryption keys will be stored for 1 month. We also have gathered your sensitive data. We would share it in case you refuse to pay. Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.

Emails

support981723721@protonmail.com

URLs

http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion

Signatures

ProLock Ransomware
Rebranded update of PwndLocker first seen in March 2020.
ransomware prolock
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\GrantUndo.raw.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\RestartDisable.tif.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\RestartDisable.tif.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\RestartDisable.tif.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\RedoTrace.png.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\RedoTrace.png.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\AssertOptimize.png.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\AssertOptimize.png.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\AssertOptimize.png.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\DebugTrace.png.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\DebugTrace.png.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\BackupAdd.tiff.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\InvokeSearch.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\InvokeSearch.tiff.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\RedoTrace.png.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\BackupAdd.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\BackupAdd.tiff.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File renamed	C:\Users\Admin\Pictures\GrantUndo.raw.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\GrantUndo.raw.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeSearch.tiff.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\Users\Admin\Pictures\DebugTrace.png.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 64 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\SLC8MVWU\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\FAVORI~1\LINKSF~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\DOCUME~1\MYPICT~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\TABLET~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\BQE06QBJ\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\Desktop\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\Recent\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\RECORD~1\SAMPLE~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\LIBRAR~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\2MTLR0RV\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\SLC8MVWU\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\Startup\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\MAINTE~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Default\STARTM~1\Programs\MAINTE~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\AJ1NIV9I\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\DOCUME~1\MYVIDE~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\XVLP3GFJ\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Default\SendTo\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\BQE06QBJ\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\93PHUZFG\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\93PHUZFG\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\SAMPLE~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\MLS6OOW4\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\ADMINI~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\VLFEZDK1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\DOWNLO~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\FAVORI~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\DOCUME~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Public\RECORD~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\XVLP3GFJ\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\USERPI~1\TaskBar\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\DOCUME~1\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\DATASE~1\DESKTOP.INI	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\2MTLR0RV\desktop.ini	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

vssadmin.exevssadmin.exe

description ioc process

File opened (read-only) \??\D: vssadmin.exe
File opened (read-only) \??\D: vssadmin.exe

description	ioc	process
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\GRINTL32.REST.trx_dll.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Task\{07DEB~1\resource.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.MSACCESS.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\AUSTRA~1\Darwin	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\Admin.dat	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\DOCUME~1\MYPICT~1\SAMPLE~1\Jellyfish.jpg.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile20.bmp.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\GROOVE~1\FORMSS~1\BRIGHT~1\BUTTON.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile14.bmp.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\ORF64A~1.V20\feature.properties.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\AG00057_.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PSRETRO.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File created	C:\PROGRA~2\MICROS~1\MEDIA\[HOW TO RECOVER FILES].TXT	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.WINWORD.DEV.14.1033.hxn.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\MICROS~2\MS.OIS.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\Toronto	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\plug_ins\Annots.api	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\MEDIA\OFFICE14\AUTOSHAP\BD18233_.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\nslist.hxl.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\AN04267_.WMF.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Pacific\Norfolk	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\1036\VISBRRES.DLL.trx_dll.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\1036\PUB6INTL.REST.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BL00105_.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.MSACCESS.14.1033.hxn	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GR3B08~1\rtf_decreaseindent.gif	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\ARGENT~1\Buenos_Aires.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Font\MyriadPro-It.otf	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0290548.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\DOCUME~1\THEMEF~1\Office Classic 2.xml	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File created	C:\PROGRA~2\MICROS~3\Common7\Packages\Debugger\[HOW TO RECOVER FILES].TXT	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\America\NORTH_~1\New_Salem.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\ASSIST~1\Client\1.0\en-US\Help_MKWD_BestBet.H1W.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0089945.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0239063.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\MEDIA\OFFICE14\BULLETS\BD15058_.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\AG00011_.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR2344~1.V20\epl-v10.html.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BOATINST.WMF.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\BD08868_.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\mset7db.kic	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\NA02373_.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PH01255G.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Device\{11352~1\overlay.png	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\XLINTL32.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\890438~1.114\resources.pak.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Etc\GMT-8.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0197979.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile35.bmp.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Device\{8702D~1\watermark.png.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\SGRES.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0309705.JPG	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\NA00494_.WMF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GROOVE~3\ERROR.GIF	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\ASSIST~1\Client\1.0\en-US\Help_CValidator.H1D.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\PLUG_I~1\3difr.x3d.proLock	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Etc\GMT+12	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

2040 net.exe
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

788 vssadmin.exe
1660 vssadmin.exe
1200 vssadmin.exe
268 vssadmin.exe
976 vssadmin.exe
1080 vssadmin.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

pid process

1676 059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

pid process

1676 059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

pid	process
2040	net.exe

pid	process
788	vssadmin.exe
1660	vssadmin.exe
1200	vssadmin.exe
268	vssadmin.exe
976	vssadmin.exe
1080	vssadmin.exe

pid	process
1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

pid	process
1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exevssvc.exe

description	pid	process
Token: SeSecurityPrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeTakeOwnershipPrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeBackupPrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeRestorePrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeManageVolumePrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeDebugPrivilege	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
Token: SeBackupPrivilege	1616	vssvc.exe
Token: SeRestorePrivilege	1616	vssvc.exe
Token: SeAuditPrivilege	1616	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1676 wrote to memory of 1548	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1548	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1548	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1548	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1548 wrote to memory of 1496	1548	net.exe	net1.exe
PID 1548 wrote to memory of 1496	1548	net.exe	net1.exe
PID 1548 wrote to memory of 1496	1548	net.exe	net1.exe
PID 1548 wrote to memory of 1496	1548	net.exe	net1.exe
PID 1676 wrote to memory of 1700	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1700	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1700	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1700	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1700 wrote to memory of 472	1700	net.exe	net1.exe
PID 1700 wrote to memory of 472	1700	net.exe	net1.exe
PID 1700 wrote to memory of 472	1700	net.exe	net1.exe
PID 1700 wrote to memory of 472	1700	net.exe	net1.exe
PID 1676 wrote to memory of 564	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 564	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 564	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 564	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 564 wrote to memory of 956	564	net.exe	net1.exe
PID 564 wrote to memory of 956	564	net.exe	net1.exe
PID 564 wrote to memory of 956	564	net.exe	net1.exe
PID 564 wrote to memory of 956	564	net.exe	net1.exe
PID 1676 wrote to memory of 288	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 288	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 288	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 288	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 288 wrote to memory of 384	288	net.exe	net1.exe
PID 288 wrote to memory of 384	288	net.exe	net1.exe
PID 288 wrote to memory of 384	288	net.exe	net1.exe
PID 288 wrote to memory of 384	288	net.exe	net1.exe
PID 1676 wrote to memory of 620	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 620	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 620	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 620	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 620 wrote to memory of 1112	620	net.exe	net1.exe
PID 620 wrote to memory of 1112	620	net.exe	net1.exe
PID 620 wrote to memory of 1112	620	net.exe	net1.exe
PID 620 wrote to memory of 1112	620	net.exe	net1.exe
PID 1676 wrote to memory of 1048	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1048	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1048	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1048	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1048 wrote to memory of 1148	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1148	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1148	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1148	1048	net.exe	net1.exe
PID 1676 wrote to memory of 1616	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1616	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1616	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1616	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1616 wrote to memory of 928	1616	net.exe	net1.exe
PID 1616 wrote to memory of 928	1616	net.exe	net1.exe
PID 1616 wrote to memory of 928	1616	net.exe	net1.exe
PID 1616 wrote to memory of 928	1616	net.exe	net1.exe
PID 1676 wrote to memory of 1308	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1308	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1308	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1676 wrote to memory of 1308	1676	059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe	net.exe
PID 1308 wrote to memory of 1456	1308	net.exe	net1.exe
PID 1308 wrote to memory of 1456	1308	net.exe	net1.exe
PID 1308 wrote to memory of 1456	1308	net.exe	net1.exe
PID 1308 wrote to memory of 1456	1308	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe
"C:\Users\Admin\AppData\Local\Temp\059dd7e81265ce033d71a4cfb42549af473d70c5a8d50bc55e741f413b6e94e5.sample.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "CSFalconService" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "CSFalconService" /y
3⤵
PID:1496

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFramework" /y
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Alerter" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Alerter" /y
3⤵
PID:956

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "AcronisAgent" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcronisAgent" /y
3⤵
PID:384

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
3⤵
PID:1112

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
3⤵
PID:1148

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
3⤵
PID:928

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
2⤵
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecManagementService" /y
3⤵
PID:904

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
2⤵
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecRPCService" /y
3⤵
PID:272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
2⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
3⤵
PID:1596

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "DFSR" /y
2⤵
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "DFSR" /y
3⤵
PID:1212

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
2⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPIntegrationService" /y
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPProtectedService" /y
2⤵
PID:1288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPProtectedService" /y
3⤵
PID:760

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPSecurityService" /y
2⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPSecurityService" /y
3⤵
PID:572

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPUpdateService" /y
2⤵
PID:1208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPUpdateService" /y
3⤵
PID:772

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MB3Service" /y
2⤵
PID:1132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MB3Service" /y
3⤵
PID:600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MBAMService" /y
2⤵
PID:1164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBAMService" /y
3⤵
PID:1532

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
2⤵
PID:320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBEndpointAgent" /y
3⤵
PID:1416

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeES" /y
2⤵
PID:1636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeES" /y
3⤵
PID:1580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
2⤵
PID:1648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
2⤵
PID:1856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMTA" /y
3⤵
PID:532

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
2⤵
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSA" /y
3⤵
PID:1628

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSRS" /y
3⤵
PID:1180

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
2⤵
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
3⤵
PID:1496

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
2⤵
PID:800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
3⤵
PID:956

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
3⤵
PID:384

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
2⤵
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeHM" /y
3⤵
PID:1112

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
2⤵
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
3⤵
PID:1148

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
2⤵
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeIS" /y
3⤵
PID:928

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
2⤵
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
2⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeRPC" /y
3⤵
PID:908

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
2⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeRepl" /y
3⤵
PID:324

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
2⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeTransport" /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
2⤵
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeUM" /y
3⤵
PID:1180

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
2⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
2⤵
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$*" /y
3⤵
PID:332

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
2⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MsDtsServer" /y
2⤵
PID:656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer" /y
3⤵
PID:1288

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MySQL57" /y
2⤵
PID:868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL57" /y
3⤵
PID:384

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "OSearch15" /y
2⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OSearch15" /y
3⤵
PID:1116

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
2⤵
PID:1112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OracleClientCache80" /y
3⤵
PID:344

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
2⤵
PID:744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "QuickBooksDB25" /y
3⤵
PID:972

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPAdminV4" /y
2⤵
PID:1780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPAdminV4" /y
3⤵
PID:1164

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
2⤵
PID:1072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPSearchHostController" /y
3⤵
PID:1580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPTraceV4" /y
2⤵
PID:1760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPTraceV4" /y
3⤵
PID:904

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
2⤵
PID:436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPUserCodeV4" /y
3⤵
PID:644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPWriterV4" /y
2⤵
PID:976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPWriterV4" /y
3⤵
PID:1036

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBrowser" /y
2⤵
PID:1856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBrowser" /y
3⤵
PID:960

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
3⤵
PID:1968

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
2⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
2⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
3⤵
PID:1608

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
2⤵
PID:2020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
3⤵
PID:900

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBackups" /y
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBackups" /y
3⤵
PID:800

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
2⤵
PID:924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$*" /y
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$*" /y
2⤵
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$*" /y
3⤵
PID:600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSMQ" /y
2⤵
PID:828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSMQ" /y
3⤵
PID:876

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer" /y
2⤵
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer" /y
3⤵
PID:560

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$*" /y
2⤵
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$*" /y
3⤵
PID:620

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLWriter" /y
2⤵
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLWriter" /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
2⤵
PID:1816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBackupAgent" /y
3⤵
PID:904

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
2⤵
PID:320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Symantec System Recovery" /y
3⤵
PID:644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
2⤵
PID:1636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
3⤵
PID:1272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
3⤵
PID:1232

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
2⤵
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
3⤵
PID:1980

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
2⤵
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
3⤵
PID:948

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
2⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
2⤵
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
3⤵
PID:1552

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
2⤵
PID:900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamMountSvc" /y
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
2⤵
PID:800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
3⤵
PID:956

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
2⤵
PID:552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
3⤵
PID:1772

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
2⤵
PID:600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamTransportSvc /y
3⤵
PID:1852

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
2⤵
PID:876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
3⤵
PID:1032

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "epag" /y
2⤵
PID:560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "epag" /y
3⤵
PID:1132

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "epredline" /y
2⤵
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "epredline" /y
3⤵
PID:928

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "mozyprobackup" /y
2⤵
PID:1456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mozyprobackup" /y
3⤵
PID:1200

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "masvc" /y
2⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "masvc" /y
3⤵
PID:1048

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "macmnsvc" /y
2⤵
PID:644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "macmnsvc" /y
3⤵
PID:1616

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "mfemms" /y
2⤵
PID:1272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfemms" /y
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
2⤵
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
3⤵
PID:272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "psqlWGE" /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "psqlWGE" /y
3⤵
PID:752

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "swprv" /y
2⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swprv" /y
3⤵
PID:1488

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "wsbexchange" /y
2⤵
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wsbexchange" /y
3⤵
PID:1544

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "WinVNC4" /y
2⤵
PID:1552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "WinVNC4" /y
3⤵
PID:2020

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "TMBMServer" /y
2⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TMBMServer" /y
3⤵
PID:2040

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "tmccsf" /y
2⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmccsf" /y
3⤵
PID:924

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "tmlisten" /y
2⤵
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmlisten" /y
3⤵
PID:1584

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
2⤵
PID:1852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VSNAPVSS" /y
3⤵
PID:828

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
2⤵
PID:1032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "stc_endpt_svc" /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "wbengine" /y
2⤵
PID:1132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:288

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "bbagent" /y
2⤵
PID:928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "bbagent" /y
3⤵
PID:1696

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "NasPmService" /y
2⤵
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NasPmService" /y
3⤵
PID:1816

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
2⤵
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
3⤵
PID:320

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
2⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
3⤵
PID:1264

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "hasplms" /y
2⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "hasplms" /y
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EqlVss" /y
2⤵
PID:272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EqlVss" /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EqlReqService" /y
2⤵
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EqlReqService" /y
3⤵
PID:1180

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
2⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "YTBackup" /y
2⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "YTBackup" /y
3⤵
PID:1608

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "vhdsvc" /y
2⤵
PID:2020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "vhdsvc" /y
3⤵
PID:900

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "TeamViewer" /y
2⤵
- Discovers systems in the same network
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TeamViewer" /y
3⤵
PID:800

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
2⤵
PID:924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
2⤵
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
3⤵
PID:600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
2⤵
PID:828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
3⤵
PID:876

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
2⤵
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
3⤵
PID:560

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
2⤵
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
3⤵
PID:620

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
2⤵
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
2⤵
PID:1816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
3⤵
PID:904

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
2⤵
PID:320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
3⤵
PID:644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
2⤵
PID:1264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROD" /y
3⤵
PID:1272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
3⤵
PID:1232

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
2⤵
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
3⤵
PID:1980

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
2⤵
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
3⤵
PID:948

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
2⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
2⤵
PID:1288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
3⤵
PID:836

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
2⤵
PID:384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
3⤵
PID:1660

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
2⤵
PID:1116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
3⤵
PID:1724

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
2⤵
PID:344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPS" /y
3⤵
PID:1772

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
2⤵
PID:600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
3⤵
PID:1852

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:1032

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
2⤵
PID:560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
3⤵
PID:1132

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
2⤵
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
3⤵
PID:928

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
2⤵
PID:1456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
3⤵
PID:1780

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
2⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
3⤵
PID:1048

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
2⤵
PID:644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
3⤵
PID:1616

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
2⤵
PID:1272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
2⤵
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
3⤵
PID:272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
3⤵
PID:752

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
2⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
3⤵
PID:1488

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
2⤵
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
2⤵
PID:836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
3⤵
PID:1096

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
3⤵
PID:1536

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
2⤵
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
3⤵
PID:760

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
2⤵
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
3⤵
PID:1584

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
2⤵
PID:1852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
3⤵
PID:828

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
2⤵
PID:1032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
2⤵
PID:1132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
3⤵
PID:288

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
2⤵
PID:928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
3⤵
PID:1696

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
2⤵
PID:1780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
3⤵
PID:1816

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
2⤵
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
3⤵
PID:320

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
2⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
3⤵
PID:1264

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
2⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
2⤵
PID:272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
2⤵
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
3⤵
PID:1180

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
2⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
2⤵
PID:1644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
3⤵
PID:1288

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
2⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
3⤵
PID:384

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
2⤵
PID:1536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
3⤵
PID:1116

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
2⤵
PID:760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
3⤵
PID:344

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
2⤵
PID:828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
3⤵
PID:876

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
2⤵
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
3⤵
PID:560

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
2⤵
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
3⤵
PID:620

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
2⤵
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPS" /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
2⤵
PID:1816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
3⤵
PID:904

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1200

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:268

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:976

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1080

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:788

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:1660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-79-0x0000000000000000-mapping.dmp

Download
memory/288-66-0x0000000000000000-mapping.dmp

Download
memory/288-118-0x0000000000000000-mapping.dmp

Download
memory/320-96-0x0000000000000000-mapping.dmp

Download
memory/384-115-0x0000000000000000-mapping.dmp

Download
memory/384-67-0x0000000000000000-mapping.dmp

Download
memory/472-63-0x0000000000000000-mapping.dmp

Download
memory/472-111-0x0000000000000000-mapping.dmp

Download
memory/532-103-0x0000000000000000-mapping.dmp

Download
memory/564-64-0x0000000000000000-mapping.dmp

Download
memory/564-116-0x0000000000000000-mapping.dmp

Download
memory/572-89-0x0000000000000000-mapping.dmp

Download
memory/600-93-0x0000000000000000-mapping.dmp

Download
memory/620-68-0x0000000000000000-mapping.dmp

Download
memory/620-120-0x0000000000000000-mapping.dmp

Download
memory/760-87-0x0000000000000000-mapping.dmp

Download
memory/772-91-0x0000000000000000-mapping.dmp

Download
memory/800-112-0x0000000000000000-mapping.dmp

Download
memory/904-77-0x0000000000000000-mapping.dmp

Download
memory/928-121-0x0000000000000000-mapping.dmp

Download
memory/928-73-0x0000000000000000-mapping.dmp

Download
memory/956-65-0x0000000000000000-mapping.dmp

Download
memory/956-113-0x0000000000000000-mapping.dmp

Download
memory/960-104-0x0000000000000000-mapping.dmp

Download
memory/1048-70-0x0000000000000000-mapping.dmp

Download
memory/1048-122-0x0000000000000000-mapping.dmp

Download
memory/1096-80-0x0000000000000000-mapping.dmp

Download
memory/1112-117-0x0000000000000000-mapping.dmp

Download
memory/1112-69-0x0000000000000000-mapping.dmp

Download
memory/1132-92-0x0000000000000000-mapping.dmp

Download
memory/1148-119-0x0000000000000000-mapping.dmp

Download
memory/1148-71-0x0000000000000000-mapping.dmp

Download
memory/1164-94-0x0000000000000000-mapping.dmp

Download
memory/1180-107-0x0000000000000000-mapping.dmp

Download
memory/1208-90-0x0000000000000000-mapping.dmp

Download
memory/1212-83-0x0000000000000000-mapping.dmp

Download
memory/1288-86-0x0000000000000000-mapping.dmp

Download
memory/1308-74-0x0000000000000000-mapping.dmp

Download
memory/1416-97-0x0000000000000000-mapping.dmp

Download
memory/1456-75-0x0000000000000000-mapping.dmp

Download
memory/1456-123-0x0000000000000000-mapping.dmp

Download
memory/1480-84-0x0000000000000000-mapping.dmp

Download
memory/1496-61-0x0000000000000000-mapping.dmp

Download
memory/1496-109-0x0000000000000000-mapping.dmp

Download
memory/1532-95-0x0000000000000000-mapping.dmp

Download
memory/1548-60-0x0000000000000000-mapping.dmp

Download
memory/1580-99-0x0000000000000000-mapping.dmp

Download
memory/1596-81-0x0000000000000000-mapping.dmp

Download
memory/1616-72-0x0000000000000000-mapping.dmp

Download
memory/1628-105-0x0000000000000000-mapping.dmp

Download
memory/1636-98-0x0000000000000000-mapping.dmp

Download
memory/1644-85-0x0000000000000000-mapping.dmp

Download
memory/1648-100-0x0000000000000000-mapping.dmp

Download
memory/1660-106-0x0000000000000000-mapping.dmp

Download
memory/1676-59-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1700-62-0x0000000000000000-mapping.dmp

Download
memory/1700-114-0x0000000000000000-mapping.dmp

Download
memory/1712-108-0x0000000000000000-mapping.dmp

Download
memory/1720-88-0x0000000000000000-mapping.dmp

Download
memory/1724-82-0x0000000000000000-mapping.dmp

Download
memory/1756-76-0x0000000000000000-mapping.dmp

Download
memory/1856-102-0x0000000000000000-mapping.dmp

Download
memory/1996-101-0x0000000000000000-mapping.dmp

Download
memory/2024-78-0x0000000000000000-mapping.dmp

Download
memory/2040-110-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads