Analysis
-
max time kernel
1800s -
max time network
1802s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
27-10-2021 08:53
Static task
static1
Behavioral task
behavioral1
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win11
Behavioral task
behavioral3
Sample
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Resource
win10-en-20211014
General
-
Target
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe
Malware Config
Extracted
C:\[HOW TO RECOVER FILES].TXT
prolock
support981723721@protonmail.com
http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion
Signatures
-
ProLock Ransomware
Rebranded update of PwndLocker first seen in March 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 28 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UnprotectEnable.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\UninstallSuspend.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\SearchNew.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\DisconnectResolve.tif.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\UnprotectEnable.png.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\Users\Admin\Pictures\WatchReceive.tiff.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File renamed C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock => C:\Users\Admin\Pictures\PingCompress.tiff.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1660 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYPICT~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\Chess\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Links\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\Desktop\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Contacts\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\CC9LYJ78\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\76WFQHVB\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\39RGOTWW\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\Games\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\TABLET~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\Startup\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOWNLO~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\EJUJZXD4\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\FAVORI~1\Links\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\FAVORI~1\LINKSF~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\STARTM~1\Programs\MAINTE~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\Hearts\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\Mahjong\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\NMB6IBU6\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\FAVORI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SendTo\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\TABLET~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYVIDE~1\SAMPLE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ADMINI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\QL5GFZT6\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\Desktop\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\SAVEDG~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\DOCUME~1\MYMUSI~1\SAMPLE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Public\RECORD~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\76WFQHVB\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\EJUJZXD4\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\DOCUME~1\MYMUSI~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\ACCESS~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\NMB6IBU6\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\PURBLE~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\SPIDER~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\MICROS~1\SOLITA~1\desktop.ini dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\DATASE~1\DESKTOP.INI dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exedescription ioc process File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\user.bmp dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\ASSIST~1\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PUBFTSCM\SCHEME15.CSS.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GROOVE~3\bg_GreenTea.gif.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0382930.JPG.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\ANTARC~1\Davis dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Pacific\Port_Moresby dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\FD01659_.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\PUB6INTL.DLL.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\charsets.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\DOCUME~1\MYPICT~1\desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\DD01166_.WMF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OUTLOO~1\BTOPENWORLD.COM.XML dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Device\{8702D~1\background.png.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\SystemV\EST5 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\Hx_1033_MTOC_Hx.HxH.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.EXCEL.DEV.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\FINCL_01.MID.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\J0151581.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\WB01243_.GIF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~2\MS.SETLANG.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR7910~1.V20\feature.xml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PUBSPAPR\ZPDIR3B.GIF dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\VideoLAN\VLC\lua\intf\dummy.luac.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\QUERIES\MSN MoneyCentral Investor Stock Quotes.iqy.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Task\{E35BE~1\en-US\resource.xml.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\ASSIST~1\Client\1.0\de-DE\Help_MValidator.H1D dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.POWERPNT.DEV.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\SystemV\EST5EDT.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\SO00935_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\jre7\lib\zi\Pacific\Wallis.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Africa\Tripoli dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\config\Modules\org-openide-actions.xml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\MICROS~3\Common7\IDE\VSTA\ITEMTE~1\CSharp\1033\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.SETLANG.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Google\Chrome\APPLIC~1\890438~1.114\Locales\ro.pak.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GR3B08~1\FormsPreviewTemplate.html dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.SETLANG.14.1033.hxn.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~1\MICROS~1\FreeCell\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File created C:\PROGRA~2\MICROS~1\Office14\[HOW TO RECOVER FILES].TXT dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PUBWIZ\DGLOGO.DPV dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\3082\MOR6INT.REST.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\STARTM~1\Programs\ACCESS~1\Desktop.ini.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile35.bmp.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OFFICE\UICAPT~1\1036\PPINTL.REST.trx_dll.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~1\USERAC~1\DEFAUL~1\usertile18.bmp.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\Pangnirtung.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\AN04332_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~2\MS.GROOVE.14.1033.hxn.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\DEVICE~1\Task\{E35BE~1\ja-JP\resource.xml.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\PE00578_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CONVERT\DELIMDOS.FAE.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~3\APPLIC~1\MICROS~2\Hx_1033_MKWD_K.HxW.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\DOCUME~1\THEMEF~1\Executive.xml dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~1\Java\jre7\lib\zi\WET.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe File opened for modification C:\PROGRA~2\MICROS~1\CLIPART\PUB60COR\TN00255_.WMF.proLock dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 1428 vssadmin.exe 796 vssadmin.exe 1568 vssadmin.exe 824 vssadmin.exe 1156 vssadmin.exe 1820 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exepid process 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exepid process 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exevssvc.exedescription pid process Token: SeSecurityPrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeTakeOwnershipPrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeBackupPrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeRestorePrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeManageVolumePrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeDebugPrivilege 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe Token: SeBackupPrivilege 1444 vssvc.exe Token: SeRestorePrivilege 1444 vssvc.exe Token: SeAuditPrivilege 1444 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1344 wrote to memory of 460 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 460 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 460 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 460 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1456 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1456 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1456 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1456 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 460 wrote to memory of 1444 460 net.exe net1.exe PID 460 wrote to memory of 1444 460 net.exe net1.exe PID 460 wrote to memory of 1444 460 net.exe net1.exe PID 460 wrote to memory of 1444 460 net.exe net1.exe PID 1456 wrote to memory of 828 1456 net.exe net1.exe PID 1456 wrote to memory of 828 1456 net.exe net1.exe PID 1456 wrote to memory of 828 1456 net.exe net1.exe PID 1456 wrote to memory of 828 1456 net.exe net1.exe PID 1344 wrote to memory of 752 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 752 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 752 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 752 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 752 wrote to memory of 756 752 net.exe net1.exe PID 752 wrote to memory of 756 752 net.exe net1.exe PID 752 wrote to memory of 756 752 net.exe net1.exe PID 752 wrote to memory of 756 752 net.exe net1.exe PID 1344 wrote to memory of 788 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 788 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 788 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 788 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 788 wrote to memory of 544 788 net.exe net1.exe PID 788 wrote to memory of 544 788 net.exe net1.exe PID 788 wrote to memory of 544 788 net.exe net1.exe PID 788 wrote to memory of 544 788 net.exe net1.exe PID 1344 wrote to memory of 1224 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1224 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1224 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1224 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1224 wrote to memory of 1568 1224 net.exe net1.exe PID 1224 wrote to memory of 1568 1224 net.exe net1.exe PID 1224 wrote to memory of 1568 1224 net.exe net1.exe PID 1224 wrote to memory of 1568 1224 net.exe net1.exe PID 1344 wrote to memory of 1068 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1068 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1068 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1068 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1068 wrote to memory of 840 1068 net.exe net1.exe PID 1068 wrote to memory of 840 1068 net.exe net1.exe PID 1068 wrote to memory of 840 1068 net.exe net1.exe PID 1068 wrote to memory of 840 1068 net.exe net1.exe PID 1344 wrote to memory of 1004 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1004 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1004 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1004 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1004 wrote to memory of 1632 1004 net.exe net1.exe PID 1004 wrote to memory of 1632 1004 net.exe net1.exe PID 1004 wrote to memory of 1632 1004 net.exe net1.exe PID 1004 wrote to memory of 1632 1004 net.exe net1.exe PID 1344 wrote to memory of 1920 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1920 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1920 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1344 wrote to memory of 1920 1344 dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe net.exe PID 1920 wrote to memory of 1208 1920 net.exe net1.exe PID 1920 wrote to memory of 1208 1920 net.exe net1.exe PID 1920 wrote to memory of 1208 1920 net.exe net1.exe PID 1920 wrote to memory of 1208 1920 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"C:\Users\Admin\AppData\Local\Temp\dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "CSFalconService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "CSFalconService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeFramework" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Alerter" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alerter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "AcronisAgent" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "DFSR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DFSR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPIntegrationService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPIntegrationService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPProtectedService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPProtectedService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPSecurityService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EPUpdateService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MB3Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MB3Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBAMService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeES" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeADTopology" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDelivery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeIS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRPC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeRepl" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeServiceHost" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeTransport" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUM" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUM" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeUMCR" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MsDtsServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MySQL57" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OSearch15" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OSearch15" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "OracleClientCache80" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "QuickBooksDB25" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPAdminV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPAdminV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPSearchHostController" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPSearchHostController" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPTraceV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPTraceV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPUserCodeV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SPWriterV4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SPWriterV4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBrowser" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackups" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackups" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSMQ" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSMQ" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$*" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$*" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLWriter" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackupAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SyncoveryVSSService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epag" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epag" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "epredline" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "epredline" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mozyprobackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "masvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "macmnsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "mfemms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "psqlWGE" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "psqlWGE" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "swprv" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swprv" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wsbexchange" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wsbexchange" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "WinVNC4" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WinVNC4" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TMBMServer" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TMBMServer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmccsf" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmccsf" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "tmlisten" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "VSNAPVSS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VSNAPVSS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "stc_endpt_svc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "wbengine" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "bbagent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bbagent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "NasPmService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NasPmService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "hasplms" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "hasplms" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlVss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlVss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "EqlReqService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EqlReqService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RapidRecoveryAgent" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "YTBackup" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "YTBackup" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "vhdsvc" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "vhdsvc" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "TeamViewer" /y2⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TeamViewer" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=D: /on=D: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" resize shadowstorage /for=C: /on=C: /maxsize=unbounded2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DFBD62~1.EXE >> NUL2⤵
- Deletes itself
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/308-94-0x0000000000000000-mapping.dmp
-
memory/436-83-0x0000000000000000-mapping.dmp
-
memory/460-56-0x0000000000000000-mapping.dmp
-
memory/460-88-0x0000000000000000-mapping.dmp
-
memory/544-63-0x0000000000000000-mapping.dmp
-
memory/620-114-0x0000000000000000-mapping.dmp
-
memory/752-60-0x0000000000000000-mapping.dmp
-
memory/752-115-0x0000000000000000-mapping.dmp
-
memory/756-61-0x0000000000000000-mapping.dmp
-
memory/760-85-0x0000000000000000-mapping.dmp
-
memory/788-62-0x0000000000000000-mapping.dmp
-
memory/824-117-0x0000000000000000-mapping.dmp
-
memory/828-59-0x0000000000000000-mapping.dmp
-
memory/840-67-0x0000000000000000-mapping.dmp
-
memory/860-102-0x0000000000000000-mapping.dmp
-
memory/864-98-0x0000000000000000-mapping.dmp
-
memory/900-77-0x0000000000000000-mapping.dmp
-
memory/912-103-0x0000000000000000-mapping.dmp
-
memory/928-97-0x0000000000000000-mapping.dmp
-
memory/952-106-0x0000000000000000-mapping.dmp
-
memory/960-90-0x0000000000000000-mapping.dmp
-
memory/972-84-0x0000000000000000-mapping.dmp
-
memory/992-78-0x0000000000000000-mapping.dmp
-
memory/1004-68-0x0000000000000000-mapping.dmp
-
memory/1068-66-0x0000000000000000-mapping.dmp
-
memory/1100-105-0x0000000000000000-mapping.dmp
-
memory/1120-93-0x0000000000000000-mapping.dmp
-
memory/1168-111-0x0000000000000000-mapping.dmp
-
memory/1208-71-0x0000000000000000-mapping.dmp
-
memory/1224-64-0x0000000000000000-mapping.dmp
-
memory/1244-96-0x0000000000000000-mapping.dmp
-
memory/1264-107-0x0000000000000000-mapping.dmp
-
memory/1344-55-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/1388-110-0x0000000000000000-mapping.dmp
-
memory/1392-119-0x0000000000000000-mapping.dmp
-
memory/1392-92-0x0000000000000000-mapping.dmp
-
memory/1396-116-0x0000000000000000-mapping.dmp
-
memory/1404-109-0x0000000000000000-mapping.dmp
-
memory/1444-58-0x0000000000000000-mapping.dmp
-
memory/1456-57-0x0000000000000000-mapping.dmp
-
memory/1472-86-0x0000000000000000-mapping.dmp
-
memory/1480-74-0x0000000000000000-mapping.dmp
-
memory/1516-113-0x0000000000000000-mapping.dmp
-
memory/1532-108-0x0000000000000000-mapping.dmp
-
memory/1568-65-0x0000000000000000-mapping.dmp
-
memory/1568-89-0x0000000000000000-mapping.dmp
-
memory/1580-82-0x0000000000000000-mapping.dmp
-
memory/1628-75-0x0000000000000000-mapping.dmp
-
memory/1632-69-0x0000000000000000-mapping.dmp
-
memory/1652-76-0x0000000000000000-mapping.dmp
-
memory/1660-99-0x0000000000000000-mapping.dmp
-
memory/1708-81-0x0000000000000000-mapping.dmp
-
memory/1720-100-0x0000000000000000-mapping.dmp
-
memory/1748-87-0x0000000000000000-mapping.dmp
-
memory/1780-118-0x0000000000000000-mapping.dmp
-
memory/1820-95-0x0000000000000000-mapping.dmp
-
memory/1896-73-0x0000000000000000-mapping.dmp
-
memory/1920-70-0x0000000000000000-mapping.dmp
-
memory/1964-112-0x0000000000000000-mapping.dmp
-
memory/1968-91-0x0000000000000000-mapping.dmp
-
memory/1976-79-0x0000000000000000-mapping.dmp
-
memory/1980-72-0x0000000000000000-mapping.dmp
-
memory/1984-104-0x0000000000000000-mapping.dmp
-
memory/1988-101-0x0000000000000000-mapping.dmp
-
memory/2032-80-0x0000000000000000-mapping.dmp