dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample

General
Target

dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe

Filesize

14KB

Completed

20-10-2021 09:15

Score
10/10
MD5

3355ace345e98406bdb331ccad568386

SHA1

81d5888bb8d43d88315c040be1f51db6bb5cf64c

SHA256

dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178

Malware Config

Extracted

Path C:\[HOW TO RECOVER FILES].TXT
Family prolock
Ransom Note
Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you have to pay the decryption fee in BTC. The final price depends on how fast you write to us. 1. Download TOR browser: https://www.torproject.org/ 2. Install the TOR Browser. 3. Open the TOR Browser. 4. Open our website in the TOR browser: msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion 5. Login using your ID D8756FE07320C1859F44 ***If you have any problems connecting or using TOR network: contact our support by email support981723721@protonmail.com [You'll receive instructions and price inside] The decryption keys will be stored for 1 month. We also have gathered your sensitive data. We would share it in case you refuse to pay. Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.
Emails

support981723721@protonmail.com

URLs

http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion

Signatures 20

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Impact
  • ProLock Ransomware

    Description

    Rebranded update of PwndLocker first seen in March 2020.

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File renamedC:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File renamedC:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File renamedC:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File renamedC:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
  • Drops startup file
    taskmgr.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\[how to recover files].txttaskmgr.exe
    File opened for modification\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.prolocktaskmgr.exe
    File opened for modification\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.prolock.prolocktaskmgr.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops desktop.ini file(s)
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\USERPI~1\TaskBar\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\SendTo\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~2\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\SYSTEM~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\ADMINI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\SendTo\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\MAINTE~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\DOCUME~1\MYPICT~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\Pictures\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\Videos\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\1033\DATASE~1\DESKTOP.INIdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\SYSTEM~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\Desktop\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\CAMERA~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\STARTM~1\Programs\SYSTEM~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\ACCOUN~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\STARTM~1\Programs\MAINTE~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\Users\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\DOCUME~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\DOCUME~1\MYMUSI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\SAVEDP~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\Links\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\DOWNLO~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\SYSTEM~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\FAVORI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\SAVEDG~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\Desktop\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\SYSTEM~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\Contacts\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\OneDrive\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\Recent\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\LIBRAR~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\DOWNLO~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\Searches\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Admin\STARTM~1\Programs\Startup\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~2\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\SYSTEM~1\Desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Default\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\DOCUME~1\Public\DOCUME~1\desktop.inidfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
  • Enumerates connected drives
    vssadmin.exevssadmin.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\D:vssadmin.exe
    File opened (read-only)\??\D:vssadmin.exe
  • Drops file in Program Files directory
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\Tracker\reviews_super.gifdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\WIN8-S~1\arrow-left-pressed.gifdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\{9AC08~1\C2RManifest.officemui.msi.16.en-us.xmldfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\UEV\TEMPLA~1\SettingsLocationTemplate2013.xsd.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\665__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\LICENS~1\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-msdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\WinWordLogoSmall.scale-100.pngdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~1\MICROS~2\root\Office16\MSIPC\no\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL027.XMLdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app\dev\nls\ja-jp\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\MF\Pending.GRL.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\246__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\MICROS~1\DIAGNO~1\DOWNLO~1\WINDOWS.PERFTRACKESCALATIONS.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\264__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\Java\JDK18~1.0_6\include\win32\bridge\AccessBridgePackages.hdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\LICENS~1\MondoR_Grace-ul-oob.xrm-msdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\715__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\717__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\UEV\INBOXT~1\MicrosoftOffice2016BackupWin32.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\LICENS~1\HomeBusinessR_OEM_Perp3-ul-phn.xrm-msdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\LICENS~1\PublisherR_OEM_Perp-ul-oob.xrm-msdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\1033\QUICKS~1\Classic.dotxdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~1\MICROS~2\root\Office16\sdxs\FA0000~1\cardview\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\vfs\PROGRA~1\MICROS~1\THEMES16\ECHO\ECHO.ELMdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app\dev\nls\ui-strings.jsdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\CREATE~1\js\nls\he-il\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\536__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\s_checkbox_unselected_18.svgdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\fss\js\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{7A30A~1\Prov\RunTime\1__Power_Policy.provxml.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\715__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxmldfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\user-48.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\710__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL011.XMLdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\Office16\PROOF\LTSHYPH_EN.LEXdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\pl-pl\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\490__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\357_nnections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\ru-ru\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\386__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxmldfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\155__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\708__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\Java\JDK18~1.0_6\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jardfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\MICROS~2\root\LICENS~1\ProPlusR_Trial-ul-oob.xrm-msdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\WALK-T~1\images\THEMEL~1\close.svgdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\{9AC08~1\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\181__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\Java\JDK18~1.0_6\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jardfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~1\MICROS~2\Updates\Apply\FILESI~1\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~1\VideoLAN\VLC\locale\lv\LC_MES~1\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~1\VideoLAN\VLC\lua\http\css\UI-LIG~1\images\ui-icons_ffffff_256x240.pngdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\themes\dark\virgo_mycomputer_folder_icon.svgdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\DeploymentConfig.0.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\111__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\496__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\645__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\457__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\STARTM~1\Programs\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File createdC:\PROGRA~1\VideoLAN\VLC\locale\hu\LC_MES~1\[HOW TO RECOVER FILES].TXTdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pt_get.svgdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    File opened for modificationC:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLockdfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
  • Drops file in Windows directory
    taskmgr.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\4183903823\1195458082.pritaskmgr.exe
    File createdC:\Windows\rescache\_merged\1601268389\3068621934.pritaskmgr.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks SCSI registry key(s)
    taskmgr.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000Ataskmgr.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyNametaskmgr.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000taskmgr.exe
  • Discovers systems in the same network
    net.exe

    Tags

    TTPs

    Remote System Discovery

    Reported IOCs

    pidprocess
    1620net.exe
  • Interacts with shadow copies
    vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    3460vssadmin.exe
    2960vssadmin.exe
    1856vssadmin.exe
    2960vssadmin.exe
    752vssadmin.exe
    3468vssadmin.exe
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exe

    Reported IOCs

    pidprocess
    2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
  • Suspicious behavior: GetForegroundWindowSpam
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exe

    Reported IOCs

    pidprocess
    2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    1876taskmgr.exe
  • Suspicious use of AdjustPrivilegeToken
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exevssvc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeSecurityPrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeTakeOwnershipPrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeBackupPrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeRestorePrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeManageVolumePrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeDebugPrivilege2412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    Token: SeDebugPrivilege1876taskmgr.exe
    Token: SeSystemProfilePrivilege1876taskmgr.exe
    Token: SeCreateGlobalPrivilege1876taskmgr.exe
    Token: SeBackupPrivilege1680vssvc.exe
    Token: SeRestorePrivilege1680vssvc.exe
    Token: SeAuditPrivilege1680vssvc.exe
  • Suspicious use of FindShellTrayWindow
    taskmgr.exe

    Reported IOCs

    pidprocess
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
  • Suspicious use of SendNotifyMessage
    taskmgr.exe

    Reported IOCs

    pidprocess
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
    1876taskmgr.exe
  • Suspicious use of WriteProcessMemory
    dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2412 wrote to memory of 34402412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 34402412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 34402412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 3440 wrote to memory of 11523440net.exenet1.exe
    PID 3440 wrote to memory of 11523440net.exenet1.exe
    PID 3440 wrote to memory of 11523440net.exenet1.exe
    PID 2412 wrote to memory of 4162412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 4162412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 4162412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 416 wrote to memory of 1332416net.exenet1.exe
    PID 416 wrote to memory of 1332416net.exenet1.exe
    PID 416 wrote to memory of 1332416net.exenet1.exe
    PID 2412 wrote to memory of 40562412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 40562412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 40562412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 4056 wrote to memory of 6564056net.exenet1.exe
    PID 4056 wrote to memory of 6564056net.exenet1.exe
    PID 4056 wrote to memory of 6564056net.exenet1.exe
    PID 2412 wrote to memory of 8642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 8642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 8642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 864 wrote to memory of 3952864net.exenet1.exe
    PID 864 wrote to memory of 3952864net.exenet1.exe
    PID 864 wrote to memory of 3952864net.exenet1.exe
    PID 2412 wrote to memory of 39482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 39482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 39482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 3948 wrote to memory of 21803948net.exenet1.exe
    PID 3948 wrote to memory of 21803948net.exenet1.exe
    PID 3948 wrote to memory of 21803948net.exenet1.exe
    PID 2412 wrote to memory of 9202412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 9202412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 9202412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 920 wrote to memory of 3520920net.exenet1.exe
    PID 920 wrote to memory of 3520920net.exenet1.exe
    PID 920 wrote to memory of 3520920net.exenet1.exe
    PID 2412 wrote to memory of 39642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 39642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 39642412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 3964 wrote to memory of 6043964net.exenet1.exe
    PID 3964 wrote to memory of 6043964net.exenet1.exe
    PID 3964 wrote to memory of 6043964net.exenet1.exe
    PID 2412 wrote to memory of 8882412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 8882412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 8882412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 888 wrote to memory of 4016888net.exenet1.exe
    PID 888 wrote to memory of 4016888net.exenet1.exe
    PID 888 wrote to memory of 4016888net.exenet1.exe
    PID 2412 wrote to memory of 32522412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 32522412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 32522412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 3252 wrote to memory of 39843252net.exenet1.exe
    PID 3252 wrote to memory of 39843252net.exenet1.exe
    PID 3252 wrote to memory of 39843252net.exenet1.exe
    PID 2412 wrote to memory of 17802412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 17802412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 17802412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 1780 wrote to memory of 37041780net.exenet1.exe
    PID 1780 wrote to memory of 37041780net.exenet1.exe
    PID 1780 wrote to memory of 37041780net.exenet1.exe
    PID 2412 wrote to memory of 27482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 27482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2412 wrote to memory of 27482412dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exe
    PID 2748 wrote to memory of 25362748net.exenet1.exe
Processes 324
  • C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"
    Modifies extensions of user files
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "CSFalconService" /y
      Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "CSFalconService" /y
        PID:1152
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
      Suspicious use of WriteProcessMemory
      PID:416
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "McAfeeFramework" /y
        PID:1332
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "Alerter" /y
      Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Alerter" /y
        PID:656
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "AcronisAgent" /y
      Suspicious use of WriteProcessMemory
      PID:864
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "AcronisAgent" /y
        PID:3952
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
      Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
        PID:2180
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
      Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
        PID:3520
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
      Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
        PID:604
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
      Suspicious use of WriteProcessMemory
      PID:888
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
        PID:4016
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
      Suspicious use of WriteProcessMemory
      PID:3252
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecManagementService" /y
        PID:3984
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
      Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecRPCService" /y
        PID:3704
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
      Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
        PID:2536
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "DFSR" /y
      PID:1684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "DFSR" /y
        PID:2080
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
      PID:1928
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EPIntegrationService" /y
        PID:4004
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EPProtectedService" /y
      PID:2492
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EPProtectedService" /y
        PID:4068
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EPSecurityService" /y
      PID:3228
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EPSecurityService" /y
        PID:2236
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EPUpdateService" /y
      PID:2936
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EPUpdateService" /y
        PID:3196
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MB3Service" /y
      PID:2024
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MB3Service" /y
        PID:3796
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MBAMService" /y
      PID:3552
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MBAMService" /y
        PID:2900
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
      PID:1816
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MBEndpointAgent" /y
        PID:420
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeES" /y
      PID:1424
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeES" /y
        PID:1156
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
      PID:1176
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
        PID:1108
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
      PID:816
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeMTA" /y
        PID:3960
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
      PID:3972
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeSA" /y
        PID:3636
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
      PID:2180
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeSRS" /y
        PID:1636
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
      PID:3520
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
        PID:1940
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
      PID:604
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
        PID:3760
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
      PID:404
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
        PID:1084
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
      PID:2764
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
        PID:1220
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
      PID:828
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeHM" /y
        PID:3988
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
      PID:1120
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
        PID:1952
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
      PID:1700
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeIS" /y
        PID:2212
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
      PID:2128
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
        PID:3000
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
      PID:3476
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeRPC" /y
        PID:3468
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
      PID:1640
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeRepl" /y
        PID:3228
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
      PID:1976
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
        PID:1584
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
      PID:1480
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeTransport" /y
        PID:3600
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
      PID:3604
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeUM" /y
        PID:2900
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
      PID:3064
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
        PID:1252
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
      PID:3928
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSOLAP$*" /y
        PID:948
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
      PID:1284
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLSERVER" /y
        PID:860
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MsDtsServer" /y
      PID:1028
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MsDtsServer" /y
        PID:1176
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MySQL57" /y
      PID:1340
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MySQL57" /y
        PID:2344
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "OSearch15" /y
      PID:2684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "OSearch15" /y
        PID:1568
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
      PID:660
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "OracleClientCache80" /y
        PID:3628
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
      PID:3616
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "QuickBooksDB25" /y
        PID:1556
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SPAdminV4" /y
      PID:2864
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SPAdminV4" /y
        PID:3068
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
      PID:1144
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SPSearchHostController" /y
        PID:3760
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SPTraceV4" /y
      PID:3508
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SPTraceV4" /y
        PID:4016
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
      PID:3252
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SPUserCodeV4" /y
        PID:3744
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SPWriterV4" /y
      PID:3480
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SPWriterV4" /y
        PID:1172
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLBrowser" /y
      PID:1204
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLBrowser" /y
        PID:2216
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
      PID:1120
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
        PID:2212
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
      PID:3032
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
        PID:3008
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
      PID:2132
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
        PID:1236
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
      PID:3044
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
        PID:2292
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLBackups" /y
      PID:3756
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLBackups" /y
        PID:2424
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
      PID:3060
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$*" /y
        PID:3796
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$*" /y
      PID:1880
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$*" /y
        PID:1884
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSMQ" /y
      PID:708
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSMQ" /y
        PID:860
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer" /y
      PID:3440
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer" /y
        PID:1168
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer$*" /y
      PID:1256
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer$*" /y
        PID:1340
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLWriter" /y
      PID:3944
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLWriter" /y
        PID:3296
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
      PID:3976
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLBackupAgent" /y
        PID:660
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
      PID:3972
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Symantec System Recovery" /y
        PID:2180
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
      PID:2116
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
        PID:1240
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
      PID:920
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
        PID:2152
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
      PID:1856
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
        PID:1672
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
      PID:1036
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
        PID:3252
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
      PID:1064
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
        PID:2328
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
      PID:1172
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
        PID:1204
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
      PID:2748
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamMountSvc" /y
        PID:1120
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
      PID:1684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
        PID:1800
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
      PID:3468
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
        PID:1960
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
      PID:312
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VeeamTransportSvc /y
        PID:2292
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
      PID:1088
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
        PID:3660
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "epag" /y
      PID:3168
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "epag" /y
        PID:1600
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "epredline" /y
      PID:1292
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "epredline" /y
        PID:708
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "mozyprobackup" /y
      PID:3856
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "mozyprobackup" /y
        PID:316
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "masvc" /y
      PID:812
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "masvc" /y
        PID:1256
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "macmnsvc" /y
      PID:1108
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "macmnsvc" /y
        PID:3944
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "mfemms" /y
      PID:3692
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "mfemms" /y
        PID:1020
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
      PID:1400
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
        PID:1032
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "psqlWGE" /y
      PID:2752
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "psqlWGE" /y
        PID:2172
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "swprv" /y
      PID:1092
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "swprv" /y
        PID:2572
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "wsbexchange" /y
      PID:2252
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wsbexchange" /y
        PID:1856
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "WinVNC4" /y
      PID:672
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "WinVNC4" /y
        PID:1036
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "TMBMServer" /y
      PID:684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "TMBMServer" /y
        PID:1064
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "tmccsf" /y
      PID:904
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "tmccsf" /y
        PID:2960
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "tmlisten" /y
      PID:1204
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "tmlisten" /y
        PID:2748
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
      PID:956
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VSNAPVSS" /y
        PID:1744
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
      PID:3208
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "stc_endpt_svc" /y
        PID:3468
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "wbengine" /y
      PID:1236
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wbengine" /y
        PID:2680
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "bbagent" /y
      PID:312
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "bbagent" /y
        PID:1640
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "NasPmService" /y
      PID:1088
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "NasPmService" /y
        PID:1480
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
      PID:3672
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
        PID:2688
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
      PID:1332
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
        PID:916
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "hasplms" /y
      PID:1296
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "hasplms" /y
        PID:1256
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EqlVss" /y
      PID:2196
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EqlVss" /y
        PID:3944
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "EqlReqService" /y
      PID:3376
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "EqlReqService" /y
        PID:1568
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
      PID:1572
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
        PID:340
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "YTBackup" /y
      PID:1400
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "YTBackup" /y
        PID:1456
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "vhdsvc" /y
      PID:2752
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "vhdsvc" /y
        PID:1656
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "TeamViewer" /y
      Discovers systems in the same network
      PID:1620
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "TeamViewer" /y
        PID:4016
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
      PID:1672
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
        PID:2764
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
      PID:4088
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
        PID:944
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
      PID:2332
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
        PID:1664
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
      PID:2216
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
        PID:1120
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
      PID:1732
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
        PID:2100
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
      PID:1800
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
        PID:3916
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
      PID:3208
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
        PID:1236
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
      PID:2492
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
        PID:3980
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
      PID:3496
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$PROD" /y
        PID:1088
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
      PID:1284
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
        PID:3672
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
      PID:3588
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
        PID:3928
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
      PID:1332
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
        PID:3856
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
      PID:640
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
        PID:1448
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
      PID:4056
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
        PID:2684
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
      PID:296
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
        PID:3692
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
      PID:660
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
        PID:2116
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
      PID:3516
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$TPS" /y
        PID:3948
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
      PID:2172
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
        PID:1376
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
      PID:2152
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
        PID:1672
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
      PID:3984
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
        PID:828
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
      PID:980
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
        PID:1952
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
      PID:1172
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
        PID:2208
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
      PID:1504
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
        PID:1720
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
      PID:3524
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
        PID:2136
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
      PID:3032
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
        PID:3044
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
      PID:2284
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
        PID:2184
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
      PID:832
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
        PID:1152
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
      PID:3060
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
        PID:2236
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
      PID:512
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLSERVER" /y
        PID:1312
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
      PID:708
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
        PID:916
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
      PID:416
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
        PID:640
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
      PID:3952
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
        PID:1568
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
      PID:2592
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
        PID:2868
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
      PID:3052
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
        PID:1456
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
      PID:1032
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
        PID:3964
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
      PID:2572
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
        PID:3508
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
      PID:1868
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
        PID:1620
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
      PID:4016
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
        PID:3992
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
      PID:2764
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
        PID:980
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
      PID:2536
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
        PID:1172
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
      PID:1972
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
        PID:1504
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
      PID:1528
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
        PID:2088
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
      PID:2136
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
        PID:1236
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
      PID:3044
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
        PID:2300
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
      PID:1584
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
        PID:1088
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
      PID:2264
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
        PID:2544
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
      PID:1288
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
        PID:584
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
      PID:3788
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
        PID:2688
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
      PID:1660
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
        PID:3640
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
      PID:3976
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
        PID:388
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
      PID:296
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
        PID:3692
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
      PID:660
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
        PID:3616
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
      PID:3516
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer$TPS" /y
        PID:604
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
      PID:2172
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
        PID:1248
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      Interacts with shadow copies
      PID:1856
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=401MB
      Enumerates connected drives
      Interacts with shadow copies
      PID:2960
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=unbounded
      Enumerates connected drives
      Interacts with shadow copies
      PID:752
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      Interacts with shadow copies
      PID:3468
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=401MB
      Interacts with shadow copies
      PID:3460
    • C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=unbounded
      Interacts with shadow copies
      PID:2960
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    Drops startup file
    Drops file in Windows directory
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:1876
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:1680
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\[HOW TO RECOVER FILES].TXT
    PID:920
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Initial Access
          Lateral Movement
            Persistence
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\[HOW TO RECOVER FILES].TXT

                  MD5

                  ceb027fc77c8dcb9379d8c820a17f057

                  SHA1

                  f25fe6da7e299e071b87b3ef220155034c965595

                  SHA256

                  1149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da

                  SHA512

                  5535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[HOW TO RECOVER FILES].TXT

                  MD5

                  ceb027fc77c8dcb9379d8c820a17f057

                  SHA1

                  f25fe6da7e299e071b87b3ef220155034c965595

                  SHA256

                  1149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da

                  SHA512

                  5535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a

                • C:\Users\Public\Desktop\[HOW TO RECOVER FILES].TXT

                  MD5

                  ceb027fc77c8dcb9379d8c820a17f057

                  SHA1

                  f25fe6da7e299e071b87b3ef220155034c965595

                  SHA256

                  1149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da

                  SHA512

                  5535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a

                • memory/404-167-0x0000000000000000-mapping.dmp

                • memory/416-117-0x0000000000000000-mapping.dmp

                • memory/420-152-0x0000000000000000-mapping.dmp

                • memory/604-128-0x0000000000000000-mapping.dmp

                • memory/604-165-0x0000000000000000-mapping.dmp

                • memory/656-120-0x0000000000000000-mapping.dmp

                • memory/816-157-0x0000000000000000-mapping.dmp

                • memory/828-171-0x0000000000000000-mapping.dmp

                • memory/864-121-0x0000000000000000-mapping.dmp

                • memory/888-129-0x0000000000000000-mapping.dmp

                • memory/920-125-0x0000000000000000-mapping.dmp

                • memory/1084-168-0x0000000000000000-mapping.dmp

                • memory/1108-156-0x0000000000000000-mapping.dmp

                • memory/1120-173-0x0000000000000000-mapping.dmp

                • memory/1152-116-0x0000000000000000-mapping.dmp

                • memory/1156-154-0x0000000000000000-mapping.dmp

                • memory/1176-155-0x0000000000000000-mapping.dmp

                • memory/1220-170-0x0000000000000000-mapping.dmp

                • memory/1332-118-0x0000000000000000-mapping.dmp

                • memory/1424-153-0x0000000000000000-mapping.dmp

                • memory/1636-162-0x0000000000000000-mapping.dmp

                • memory/1684-137-0x0000000000000000-mapping.dmp

                • memory/1700-175-0x0000000000000000-mapping.dmp

                • memory/1780-133-0x0000000000000000-mapping.dmp

                • memory/1816-151-0x0000000000000000-mapping.dmp

                • memory/1928-139-0x0000000000000000-mapping.dmp

                • memory/1940-164-0x0000000000000000-mapping.dmp

                • memory/1952-174-0x0000000000000000-mapping.dmp

                • memory/2024-147-0x0000000000000000-mapping.dmp

                • memory/2080-138-0x0000000000000000-mapping.dmp

                • memory/2128-177-0x0000000000000000-mapping.dmp

                • memory/2180-161-0x0000000000000000-mapping.dmp

                • memory/2180-124-0x0000000000000000-mapping.dmp

                • memory/2212-176-0x0000000000000000-mapping.dmp

                • memory/2236-144-0x0000000000000000-mapping.dmp

                • memory/2492-141-0x0000000000000000-mapping.dmp

                • memory/2536-136-0x0000000000000000-mapping.dmp

                • memory/2748-135-0x0000000000000000-mapping.dmp

                • memory/2764-169-0x0000000000000000-mapping.dmp

                • memory/2900-150-0x0000000000000000-mapping.dmp

                • memory/2936-145-0x0000000000000000-mapping.dmp

                • memory/3000-178-0x0000000000000000-mapping.dmp

                • memory/3196-146-0x0000000000000000-mapping.dmp

                • memory/3228-143-0x0000000000000000-mapping.dmp

                • memory/3252-131-0x0000000000000000-mapping.dmp

                • memory/3440-115-0x0000000000000000-mapping.dmp

                • memory/3520-126-0x0000000000000000-mapping.dmp

                • memory/3520-163-0x0000000000000000-mapping.dmp

                • memory/3552-149-0x0000000000000000-mapping.dmp

                • memory/3636-160-0x0000000000000000-mapping.dmp

                • memory/3704-134-0x0000000000000000-mapping.dmp

                • memory/3760-166-0x0000000000000000-mapping.dmp

                • memory/3796-148-0x0000000000000000-mapping.dmp

                • memory/3948-123-0x0000000000000000-mapping.dmp

                • memory/3952-122-0x0000000000000000-mapping.dmp

                • memory/3960-158-0x0000000000000000-mapping.dmp

                • memory/3964-127-0x0000000000000000-mapping.dmp

                • memory/3972-159-0x0000000000000000-mapping.dmp

                • memory/3984-132-0x0000000000000000-mapping.dmp

                • memory/3988-172-0x0000000000000000-mapping.dmp

                • memory/4004-140-0x0000000000000000-mapping.dmp

                • memory/4016-130-0x0000000000000000-mapping.dmp

                • memory/4056-119-0x0000000000000000-mapping.dmp

                • memory/4068-142-0x0000000000000000-mapping.dmp