prolock | 9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91

General

Target

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Size

5.0MB
MD5

c182610dd437f90d0cc6cb0ac19cfdb7
SHA1

9729820748673938e057ce74d007b758f6f9b195
SHA256

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91
SHA512

618bb4559c36eec0b8e3552c16b94b0060d68186b9864ca6670d8a17225088a69a498a367a226f5944a3b7d79a61565cd7123e27001053000b6d42d86352051a

Score

10^/10

prolock ransomware

Malware Config

Extracted

Path

C:\[HOW TO RECOVER FILES].TXT

Family

prolock

Ransom Note

Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you have to pay the decryption fee in BTC. The final price depends on how fast you write to us. 1. Download TOR browser: https://www.torproject.org/ 2. Install the TOR Browser. 3. Open the TOR Browser. 4. Open our website in the TOR browser: ug76vzhn2fujp6of2mjb6rjt4rploqe4q5gr2bkuaiwmzpf7nehzpsqd.onion 5. Login using your ID PPD8535CAAEC677E9FAF ***If you have any problems connecting or using TOR network: contact our support by email chec1kyourf1les@protonmail.com [You'll receive instructions and price inside] The decryption keys will be stored for 1 month. We also have gathered your sensitive data. We would share it in case you refuse to pay. Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.

Emails

chec1kyourf1les@protonmail.com

URLs

http://ug76vzhn2fujp6of2mjb6rjt4rploqe4q5gr2bkuaiwmzpf7nehzpsqd.onion

Signatures

ProLock Ransomware
Rebranded update of PwndLocker first seen in March 2020.
ransomware prolock

Drops desktop.ini file(s) 64 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

description	ioc	process
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\H2R8HLJC\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\SAVEDG~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\DBS3QI6C\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\VL9MRVWS\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\ZKOSACOX\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\TEMPOR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\STARTM~1\Programs\ADMINI~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\DBS3QI6C\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\E16QEJ8K\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\Links\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\DBS3QI6C\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\TEMPOR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\Searches\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\E16QEJ8K\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\TEMPOR~1\Content.IE5\AKOZAZUE\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Public\DOCUME~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Public\LIBRAR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Public\RECORD~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\FAVORI~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\VL9MRVWS\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Default\STARTM~1\Programs\ACCESS~1\SYSTEM~1\Desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\DBS3QI6C\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\AKOZAZUE\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\History\History.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\E16QEJ8K\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\VL9MRVWS\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\MICROS~1\Hearts\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\H2R8HLJC\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\H2R8HLJC\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\FEEDSC~1\ZZZ3YRT4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\8927RJE4\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\MICROS~1\FEEDSC~1\E16QEJ8K\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\AKOZAZUE\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\DOCUME~1\Admin\LOCALS~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\TEMPOR~1\Content.IE5\desktop.ini	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

pid process

2036 9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Drops file in Program Files directory 64 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

description	ioc	process
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.alert_5.5.0.165303.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\css\mobile.css	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Asia\Hong_Kong	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\ms\LC_MES~1\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\WriteSend.mpeg	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Asia\Omsk	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\America\Swift_Current	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\ro\LC_MES~1\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\IDTEMP~1\ENU\AdobeID.pdf	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\css\UI-LIG~1\images\ui-bg_gloss-wave_35_f6a828_500x100.png	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Europe\Kaliningrad	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\UPDATE~1\org-netbeans-modules-masterfs-nio2.xml	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Africa\Khartoum	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Asia\Irkutsk	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\AUSTRA~1\Eucla	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\ConvertToRemove.inf	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Etc\GMT-4	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\UPDATE~1\com-sun-tools-visualvm-heapdump.xml	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\ANTARC~1\Mawson	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Tracker\warning.gif	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\Lima	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Asia\Yerevan	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR2344~1.V20\META-INF\ECLIPSE_.SF	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\America\Curacao	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\ga\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\Kentucky\Louisville	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\profiler\config\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\cs\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\ORF64A~1.V20\epl-v10.html	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\p2\ORGECL~1.COR\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\DenyUpdate.mp3	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Asia\Riyadh87	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\bs\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\sk\LC_MES~1\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\America\ARGENT~1\Rio_Gallegos	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\SystemV\YST9YDT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\gl\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\PDFSigQFormalRep.pdf	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\DICTIO~1\en-US-9-0.bdic	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\features\OR7BC3~1.V20\epl-v10.html	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\MICROS~1\Mahjong\en-US\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~2\Adobe\READER~1.0\Reader\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~2\Adobe\READER~1.0\Resource\TYPESU~1\Unicode\ICU\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\890438~1.114\EXTENS~1\external_extensions.json	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\MISSIO~1\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Asia\Yekaterinburg	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\lg\LC_MES~1\[HOW TO RECOVER FILES].TXT	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Legal\ENU\license.html	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\jre\lib\zi\Atlantic\Azores	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\JDK17~1.0_8\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Europe\Kaliningrad	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\Java\jre7\lib\zi\Africa\Cairo	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
File opened for modification	C:\PROGRA~1\MICROS~1\MULTIP~1\Checkers\en-US\chkrzm.exe.mui	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

2624 net.exe
Runs net.exe

pid	process
2624	net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

pid	process
2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

pid process

2036 9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

description	pid	process
Token: SeSecurityPrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Token: SeTakeOwnershipPrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Token: SeBackupPrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Token: SeRestorePrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Token: SeManageVolumePrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
Token: SeDebugPrivilege	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe

description	pid	process	target process
PID 2036 wrote to memory of 1356	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1356	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1356	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1356	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1676	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1676	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1676	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1676	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1092	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1092	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1092	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1092	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 952	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 952	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 952	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 952	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 436	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 436	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 436	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 436	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1040	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1040	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1040	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1040	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 456	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 456	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 456	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 456	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1412	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1412	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1412	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1412	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1072	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1072	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1072	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1072	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 756	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 756	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 756	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 756	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 960	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 960	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 960	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 960	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 792	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 792	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 792	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 792	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 336	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 336	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 336	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 336	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1484	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1484	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1484	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1484	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1976	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1976	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1976	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 1976	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 840	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 840	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 840	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe
PID 2036 wrote to memory of 840	2036	9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe
"C:\Users\Admin\AppData\Local\Temp\9c2bab6fc93db69b1b4771a0f599255728c8a1d0636a4c23f74190ef5f5def91.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "CSFalconService" /y
2⤵
PID:1356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "CSFalconService" /y
3⤵
PID:2280

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
2⤵
PID:1676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFramework" /y
3⤵
PID:2116

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Alerter" /y
2⤵
PID:1092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Alerter" /y
3⤵
PID:2100

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "AcronisAgent" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcronisAgent" /y
3⤵
PID:2264

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
2⤵
PID:436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
3⤵
PID:2092

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
2⤵
PID:1040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
2⤵
PID:456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
3⤵
PID:2108

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
2⤵
PID:1412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
3⤵
PID:2132

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
2⤵
PID:1072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecManagementService" /y
3⤵
PID:2248

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
2⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecRPCService" /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
2⤵
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
3⤵
PID:2232

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "DFSR" /y
2⤵
PID:792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "DFSR" /y
3⤵
PID:2216

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
2⤵
PID:336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPIntegrationService" /y
3⤵
PID:2240

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPProtectedService" /y
2⤵
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPProtectedService" /y
3⤵
PID:2004

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPSecurityService" /y
2⤵
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPSecurityService" /y
3⤵
PID:2208

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EPUpdateService" /y
2⤵
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPUpdateService" /y
3⤵
PID:2192

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MB3Service" /y
2⤵
PID:856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MB3Service" /y
3⤵
PID:2256

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MBAMService" /y
2⤵
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBAMService" /y
3⤵
PID:2164

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
2⤵
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBEndpointAgent" /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeES" /y
2⤵
PID:1404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeES" /y
3⤵
PID:2148

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
2⤵
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
3⤵
PID:1080

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
2⤵
PID:1916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMTA" /y
3⤵
PID:2124

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
2⤵
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSA" /y
3⤵
PID:1700

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
2⤵
PID:1908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSRS" /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
2⤵
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
3⤵
PID:2184

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
2⤵
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
3⤵
PID:2176

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
2⤵
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
3⤵
PID:2084

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
2⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
3⤵
PID:2156

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
2⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeHM" /y
3⤵
PID:1632

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
2⤵
PID:2060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
3⤵
PID:2292

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
2⤵
PID:2348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeIS" /y
3⤵
PID:2412

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
2⤵
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
3⤵
PID:2420

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
2⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeRPC" /y
3⤵
PID:2452

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
2⤵
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeRepl" /y
3⤵
PID:2484

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
2⤵
PID:2492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
3⤵
PID:2516

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
2⤵
PID:2524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeTransport" /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
2⤵
PID:2556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeUM" /y
3⤵
PID:2580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
2⤵
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
2⤵
PID:2612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$*" /y
3⤵
PID:2684

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
2⤵
PID:2636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:2668

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MsDtsServer" /y
2⤵
PID:2676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer" /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MySQL57" /y
2⤵
PID:2708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL57" /y
3⤵
PID:2740

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "OSearch15" /y
2⤵
PID:2748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OSearch15" /y
3⤵
PID:2772

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OracleClientCache80" /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
2⤵
PID:2812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "QuickBooksDB25" /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPAdminV4" /y
2⤵
PID:2844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPAdminV4" /y
3⤵
PID:2868

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPSearchHostController" /y
3⤵
PID:2900

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPTraceV4" /y
2⤵
PID:2908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPTraceV4" /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
2⤵
PID:2916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPUserCodeV4" /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SPWriterV4" /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SPWriterV4" /y
3⤵
PID:2996

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBrowser" /y
2⤵
PID:2932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBrowser" /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
2⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
3⤵
PID:2440

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
2⤵
PID:3020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
3⤵
PID:2372

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
2⤵
PID:2568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
3⤵
PID:2760

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
2⤵
PID:2824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
3⤵
PID:2296

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBackups" /y
2⤵
PID:2872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBackups" /y
3⤵
PID:2464

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
2⤵
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$*" /y
3⤵
PID:2276

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$*" /y
2⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$*" /y
3⤵
PID:2468

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSMQ" /y
2⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSMQ" /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer" /y
2⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer" /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$*" /y
2⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$*" /y
3⤵
PID:2132

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLWriter" /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLWriter" /y
3⤵
PID:2580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
2⤵
PID:1988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBackupAgent" /y
3⤵
PID:1892

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Symantec System Recovery" /y
3⤵
PID:2208

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
2⤵
PID:2088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
3⤵
PID:2236

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
2⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
3⤵
PID:2692

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
2⤵
PID:2404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
3⤵
PID:1468

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
2⤵
PID:456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
3⤵
PID:2168

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
2⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
3⤵
PID:2248

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
2⤵
PID:2668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
3⤵
PID:2080

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamMountSvc" /y
3⤵
PID:2884

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
2⤵
PID:2732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
3⤵
PID:2860

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
2⤵
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
3⤵
PID:2864

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamTransportSvc /y
3⤵
PID:2788

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
2⤵
PID:1052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
3⤵
PID:1952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "epag" /y
2⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "epag" /y
3⤵
PID:2012

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "epredline" /y
2⤵
PID:556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "epredline" /y
3⤵
PID:1216

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "mozyprobackup" /y
2⤵
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mozyprobackup" /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "masvc" /y
2⤵
PID:816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "masvc" /y
3⤵
PID:920

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "macmnsvc" /y
2⤵
PID:1272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "macmnsvc" /y
3⤵
PID:1004

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "mfemms" /y
2⤵
PID:964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfemms" /y
3⤵
PID:1584

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
2⤵
PID:2560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
3⤵
PID:2576

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "psqlWGE" /y
2⤵
PID:1008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "psqlWGE" /y
3⤵
PID:1704

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "swprv" /y
2⤵
PID:240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swprv" /y
3⤵
PID:1976

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "wsbexchange" /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wsbexchange" /y
3⤵
PID:1948

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "WinVNC4" /y
2⤵
PID:336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "WinVNC4" /y
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "TMBMServer" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TMBMServer" /y
3⤵
PID:740

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "tmccsf" /y
2⤵
PID:1132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmccsf" /y
3⤵
PID:2816

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "tmlisten" /y
2⤵
PID:2828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmlisten" /y
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VSNAPVSS" /y
3⤵
PID:1356

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
2⤵
PID:1464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "stc_endpt_svc" /y
3⤵
PID:1812

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "wbengine" /y
2⤵
PID:1040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:968

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "bbagent" /y
2⤵
PID:592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "bbagent" /y
3⤵
PID:1792

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "NasPmService" /y
2⤵
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NasPmService" /y
3⤵
PID:1072

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
2⤵
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
3⤵
PID:2636

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
2⤵
PID:2644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
3⤵
PID:3032

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "hasplms" /y
2⤵
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "hasplms" /y
3⤵
PID:2924

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EqlVss" /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EqlVss" /y
3⤵
PID:2908

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "EqlReqService" /y
2⤵
PID:2940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EqlReqService" /y
3⤵
PID:2400

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
2⤵
PID:3064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
3⤵
PID:2440

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "YTBackup" /y
2⤵
PID:2076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "YTBackup" /y
3⤵
PID:3036

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "vhdsvc" /y
2⤵
PID:3028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "vhdsvc" /y
3⤵
PID:2568

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "TeamViewer" /y
2⤵
- Discovers systems in the same network
PID:2624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TeamViewer" /y
3⤵
PID:2744

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
2⤵
PID:2824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
3⤵
PID:1708

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
2⤵
PID:2872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
3⤵
PID:2808

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
2⤵
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
3⤵
PID:2460

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
2⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
3⤵
PID:2292

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
2⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
3⤵
PID:2104

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
2⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
3⤵
PID:2148

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
2⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
3⤵
PID:2584

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
2⤵
PID:1988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROD" /y
3⤵
PID:2176

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
3⤵
PID:1152

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
2⤵
PID:2088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
3⤵
PID:2392

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
2⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
3⤵
PID:2396

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
2⤵
PID:2404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
3⤵
PID:1224

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
2⤵
PID:2200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
3⤵
PID:2188

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
2⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
3⤵
PID:2688

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
2⤵
PID:2668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
3⤵
PID:2072

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPS" /y
3⤵
PID:2844

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
2⤵
PID:2732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
3⤵
PID:2604

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:1952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
2⤵
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
3⤵
PID:2012

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
2⤵
PID:836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
3⤵
PID:1216

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
2⤵
PID:528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
2⤵
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
3⤵
PID:920

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
2⤵
PID:1412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
3⤵
PID:1004

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
2⤵
PID:2768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
3⤵
PID:2532

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
3⤵
PID:1676

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
2⤵
PID:2384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
3⤵
PID:1768

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
2⤵
PID:2560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
3⤵
PID:2368

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
2⤵
PID:1008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:1088

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
2⤵
PID:240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
3⤵
PID:1840

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
3⤵
PID:2448

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
2⤵
PID:336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
3⤵
PID:1748

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
2⤵
PID:2812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
3⤵
PID:1464

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
2⤵
PID:1644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
3⤵
PID:1544

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
2⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
3⤵
PID:1040

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
3⤵
PID:1060

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
2⤵
PID:572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
3⤵
PID:592

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
2⤵
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
3⤵
PID:1124

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
2⤵
PID:396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
3⤵
PID:620

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
2⤵
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
3⤵
PID:2644

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
2⤵
PID:3008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
3⤵
PID:2984

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
2⤵
PID:2964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
2⤵
PID:3024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
3⤵
PID:2972

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
2⤵
PID:3060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
3⤵
PID:3020

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
2⤵
PID:3068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
3⤵
PID:2980

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
2⤵
PID:2696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
3⤵
PID:2932

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
2⤵
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
3⤵
PID:2760

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:2480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:2888

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
2⤵
PID:2808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
2⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
3⤵
PID:2144

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
2⤵
PID:2416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
3⤵
PID:2952

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
2⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPS" /y
3⤵
PID:2152

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
2⤵
PID:2260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
3⤵
PID:2140

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-56-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2036-55-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2036-57-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2036-58-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2036-59-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2036-60-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2036-61-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads