fe7b7e66461a7d806d4d2f5e6fad20499e4bc1de500a4d8cc46c5a6442f6b473

General

Target

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
Size

622KB
MD5

f05b57cdc3420acc359efe9e4941c428
SHA1

c06377e90b73bb25d30d385d7e75ae500c7bdc16
SHA256

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe
SHA512

f5f666f0eeaa12f6896a00f41e07b4333e8afd9cf97f0358eed07c302a911cb56e20c7c52b8dc6c3388a0549a5bda0572141c7c7747029c97fd5f9a682563736
SSDEEP

12288:2AkaGQbDzAaAHZsznxmFoKXjHjq0eO7xWmgTWJJCy50+z63LcTpQ2vkV+3a3Jl94:2AvrggdqUjeLFsmXWfhANTSw0u6POokl

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

F:\!!!READ_ME_MEDUSA!!!.txt

Ransom Note

$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Wings To Go !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. We have penetrated your entire network and researched all about your data. And we have copied all of your confidential data and uploaded to private storage. 2. We have ENCRYPTED your files. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your critial data to the public and send emails to your competitors. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues. After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 2 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/ http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( MedusaSupport@cock.li ) Company identification hash: dbd7a08e9e4e35ddfe197d69b5b0aa17bc7ee1c91b3ed8a104a18323f8fde51b

Emails

MedusaSupport@cock.li

URLs

http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/

http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d

Signatures

Renames multiple (8742) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops startup file 5 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Public\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Drops file in Program Files directory 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\Windows Defender\es-ES\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-300.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-150.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Tolerance.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_5.m4a	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-16_altform-lightunplated.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\fi.pak	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-400.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-100_contrast-white.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\151.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-white.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\af_get.svg	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\ui-strings.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\QUERIES\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Match.ps1	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\he.pak	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-30_altform-lightunplated.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\adojavas.inc	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\!!!READ_ME_MEDUSA!!!.txt	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-150_contrast-white.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\TwoWayBlendPage.xbf	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO99LRES.DLL	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-200.png	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeOfType.ps1	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6804 4236 WerFault.exe 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

pid	pid_target	process	target process
6804	4236	WerFault.exe	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Kills process with taskkill 44 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5636	taskkill.exe
6284	taskkill.exe
6028	taskkill.exe
6880	taskkill.exe
6180	taskkill.exe
6344	taskkill.exe
6516	taskkill.exe
6816	taskkill.exe
6576	taskkill.exe
6640	taskkill.exe
6872	taskkill.exe
7112	taskkill.exe
6200	taskkill.exe
5968	taskkill.exe
5564	taskkill.exe
5356	taskkill.exe
6260	taskkill.exe
6748	taskkill.exe
6532	taskkill.exe
6824	taskkill.exe
7156	taskkill.exe
6016	taskkill.exe
1836	taskkill.exe
6160	taskkill.exe
6408	taskkill.exe
6592	taskkill.exe
6684	taskkill.exe
5144	taskkill.exe
5432	taskkill.exe
5188	taskkill.exe
6456	taskkill.exe
6220	taskkill.exe
6976	taskkill.exe
6400	taskkill.exe
6700	taskkill.exe
6756	taskkill.exe
6796	taskkill.exe
6280	taskkill.exe
5244	taskkill.exe
4544	taskkill.exe
5616	taskkill.exe
6420	taskkill.exe
6340	taskkill.exe
6372	taskkill.exe

Modifies registry class 2 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{E0D8468C-340A-4096-8223-48828BDD25C7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

7440 PING.EXE

pid	process
7440	PING.EXE

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	5432	taskkill.exe
Token: SeDebugPrivilege	5636	taskkill.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	5188	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	6160	taskkill.exe
Token: SeDebugPrivilege	6220	taskkill.exe
Token: SeDebugPrivilege	6284	taskkill.exe
Token: SeDebugPrivilege	6344	taskkill.exe
Token: SeDebugPrivilege	6400	taskkill.exe
Token: SeDebugPrivilege	6456	taskkill.exe
Token: SeDebugPrivilege	6516	taskkill.exe
Token: SeDebugPrivilege	6576	taskkill.exe
Token: SeDebugPrivilege	6640	taskkill.exe
Token: SeDebugPrivilege	6700	taskkill.exe
Token: SeDebugPrivilege	6756	taskkill.exe
Token: SeDebugPrivilege	6816	taskkill.exe
Token: SeDebugPrivilege	6872	taskkill.exe
Token: SeDebugPrivilege	6976	taskkill.exe
Token: SeDebugPrivilege	7112	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	6200	taskkill.exe
Token: SeDebugPrivilege	6260	taskkill.exe
Token: SeDebugPrivilege	6340	taskkill.exe
Token: SeDebugPrivilege	6372	taskkill.exe
Token: SeDebugPrivilege	6408	taskkill.exe
Token: SeDebugPrivilege	6532	taskkill.exe
Token: SeDebugPrivilege	6592	taskkill.exe
Token: SeDebugPrivilege	6684	taskkill.exe
Token: SeDebugPrivilege	6748	taskkill.exe
Token: SeDebugPrivilege	6796	taskkill.exe
Token: SeDebugPrivilege	6824	taskkill.exe
Token: SeDebugPrivilege	6880	taskkill.exe
Token: SeDebugPrivilege	7156	taskkill.exe
Token: SeDebugPrivilege	6180	taskkill.exe
Token: SeDebugPrivilege	6280	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	6420	taskkill.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe
Token: SeShutdownPrivilege	3164	explorer.exe
Token: SeCreatePagefilePrivilege	3164	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

explorer.exe

pid process

3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

explorer.exe

pid process

3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe
3164 explorer.exe

pid	process
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe

pid	process
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe
3164	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 4236 wrote to memory of 4972	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4972	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4972	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4972 wrote to memory of 2216	4972	net.exe	net1.exe
PID 4972 wrote to memory of 2216	4972	net.exe	net1.exe
PID 4972 wrote to memory of 2216	4972	net.exe	net1.exe
PID 4236 wrote to memory of 1396	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 1396	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 1396	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 1396 wrote to memory of 4772	1396	net.exe	net1.exe
PID 1396 wrote to memory of 4772	1396	net.exe	net1.exe
PID 1396 wrote to memory of 4772	1396	net.exe	net1.exe
PID 4236 wrote to memory of 2900	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 2900	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 2900	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2900 wrote to memory of 4884	2900	net.exe	net1.exe
PID 2900 wrote to memory of 4884	2900	net.exe	net1.exe
PID 2900 wrote to memory of 4884	2900	net.exe	net1.exe
PID 4236 wrote to memory of 4108	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4108	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4108	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4108 wrote to memory of 4380	4108	net.exe	net1.exe
PID 4108 wrote to memory of 4380	4108	net.exe	net1.exe
PID 4108 wrote to memory of 4380	4108	net.exe	net1.exe
PID 4236 wrote to memory of 4436	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4436	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4436	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4436 wrote to memory of 4332	4436	net.exe	net1.exe
PID 4436 wrote to memory of 4332	4436	net.exe	net1.exe
PID 4436 wrote to memory of 4332	4436	net.exe	net1.exe
PID 4236 wrote to memory of 3880	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 3880	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 3880	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 3880 wrote to memory of 3472	3880	net.exe	net1.exe
PID 3880 wrote to memory of 3472	3880	net.exe	net1.exe
PID 3880 wrote to memory of 3472	3880	net.exe	net1.exe
PID 4236 wrote to memory of 1308	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 1308	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 1308	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 1308 wrote to memory of 508	1308	net.exe	net1.exe
PID 1308 wrote to memory of 508	1308	net.exe	net1.exe
PID 1308 wrote to memory of 508	1308	net.exe	net1.exe
PID 4236 wrote to memory of 2860	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 2860	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 2860	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 2860 wrote to memory of 2712	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2712	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2712	2860	net.exe	net1.exe
PID 4236 wrote to memory of 5092	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 5092	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 5092	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 5092 wrote to memory of 3516	5092	net.exe	net1.exe
PID 5092 wrote to memory of 3516	5092	net.exe	net1.exe
PID 5092 wrote to memory of 3516	5092	net.exe	net1.exe
PID 4236 wrote to memory of 3204	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 3204	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 3204	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 3204 wrote to memory of 856	3204	net.exe	net1.exe
PID 3204 wrote to memory of 856	3204	net.exe	net1.exe
PID 3204 wrote to memory of 856	3204	net.exe	net1.exe
PID 4236 wrote to memory of 4916	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4916	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4236 wrote to memory of 4916	4236	94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe	net.exe
PID 4916 wrote to memory of 2144	4916	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
"C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\net.exe
net stop "Acronis VSS Provider" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
3⤵
PID:2216

C:\Windows\SysWOW64\net.exe
net stop "Enterprise Client Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Enterprise Client Service" /y
3⤵
PID:4772

C:\Windows\SysWOW64\net.exe
net stop "Sophos Agent" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Agent" /y
3⤵
PID:4884

C:\Windows\SysWOW64\net.exe
net stop "Sophos AutoUpdate Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
3⤵
PID:4380

C:\Windows\SysWOW64\net.exe
net stop "Sophos Clean Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Clean Service" /y
3⤵
PID:4332

C:\Windows\SysWOW64\net.exe
net stop "Sophos Device Control Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
3⤵
PID:3472

C:\Windows\SysWOW64\net.exe
net stop "Sophos File Scanner Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
3⤵
PID:508

C:\Windows\SysWOW64\net.exe
net stop "Sophos Health Service" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Health Service" /y
3⤵
PID:2712

C:\Windows\SysWOW64\net.exe
net stop "Sophos MCS Agent" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
3⤵
PID:3516

C:\Windows\SysWOW64\net.exe
net stop "Sophos MCS Client" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos MCS Client" /y
3⤵
PID:856

C:\Windows\SysWOW64\net.exe
net stop "Sophos Message Router" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Message Router" /y
3⤵
PID:2144

C:\Windows\SysWOW64\net.exe
net stop "Sophos Safestore Service" /y
2⤵
PID:1912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
3⤵
PID:4496

C:\Windows\SysWOW64\net.exe
net stop "Sophos System Protection Service" /y
2⤵
PID:2548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
3⤵
PID:2020

C:\Windows\SysWOW64\net.exe
net stop "Sophos Web Control Service" /y
2⤵
PID:1304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
3⤵
PID:3968

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Backup Service" /y
2⤵
PID:5108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
3⤵
PID:1992

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Filter Service" /y
2⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
3⤵
PID:3636

C:\Windows\SysWOW64\net.exe
net stop "Symantec System Recovery" /y
2⤵
PID:4792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Symantec System Recovery" /y
3⤵
PID:2348

C:\Windows\SysWOW64\net.exe
net stop "Veeam Backup Catalog Data Service" /y
2⤵
PID:2688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
3⤵
PID:1324

C:\Windows\SysWOW64\net.exe
net stop "AcronisAgent" /y
2⤵
PID:4504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcronisAgent" /y
3⤵
PID:1216

C:\Windows\SysWOW64\net.exe
net stop "AcrSch2Svc" /y
2⤵
PID:3220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AcrSch2Svc" /y
3⤵
PID:1172

C:\Windows\SysWOW64\net.exe
net stop "Antivirus" /y
2⤵
PID:4788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Antivirus" /y
3⤵
PID:2284

C:\Windows\SysWOW64\net.exe
net stop "ARSM" /y
2⤵
PID:2396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ARSM" /y
3⤵
PID:1692

C:\Windows\SysWOW64\net.exe
net stop "BackupExecAgentAccelerator" /y
2⤵
PID:2004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
3⤵
PID:3496

C:\Windows\SysWOW64\net.exe
net stop "BackupExecAgentBrowser" /y
2⤵
PID:4228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
3⤵
PID:1552

C:\Windows\SysWOW64\net.exe
net stop "BackupExecDeviceMediaService" /y
2⤵
PID:2068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
3⤵
PID:2732

C:\Windows\SysWOW64\net.exe
net stop "BackupExecJobEngine" /y
2⤵
PID:4268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
3⤵
PID:1036

C:\Windows\SysWOW64\net.exe
net stop "BackupExecManagementService" /y
2⤵
PID:3508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecManagementService" /y
3⤵
PID:4668

C:\Windows\SysWOW64\net.exe
net stop "BackupExecRPCService" /y
2⤵
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecRPCService" /y
3⤵
PID:4356

C:\Windows\SysWOW64\net.exe
net stop "BackupExecVSSProvider" /y
2⤵
PID:4340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
3⤵
PID:4364

C:\Windows\SysWOW64\net.exe
net stop "bedbg" /y
2⤵
PID:4968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "bedbg" /y
3⤵
PID:5048

C:\Windows\SysWOW64\net.exe
net stop "DCAgent" /y
2⤵
PID:864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "DCAgent" /y
3⤵
PID:3292

C:\Windows\SysWOW64\net.exe
net stop "EPSecurityService" /y
2⤵
PID:3992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPSecurityService" /y
3⤵
PID:3188

C:\Windows\SysWOW64\net.exe
net stop "EPUpdateService" /y
2⤵
PID:944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EPUpdateService" /y
3⤵
PID:3032

C:\Windows\SysWOW64\net.exe
net stop "EraserSvc11710" /y
2⤵
PID:184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EraserSvc11710" /y
3⤵
PID:4880

C:\Windows\SysWOW64\net.exe
net stop "EsgShKernel" /y
2⤵
PID:4284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EsgShKernel" /y
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net stop "FA_Scheduler" /y
2⤵
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "FA_Scheduler" /y
3⤵
PID:1676

C:\Windows\SysWOW64\net.exe
net stop "IISAdmin" /y
2⤵
PID:3280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IISAdmin" /y
3⤵
PID:4976

C:\Windows\SysWOW64\net.exe
net stop "IMAP4Svc" /y
2⤵
PID:3728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IMAP4Svc" /y
3⤵
PID:1176

C:\Windows\SysWOW64\net.exe
net stop "macmnsvc" /y
2⤵
PID:392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "macmnsvc" /y
3⤵
PID:4032

C:\Windows\SysWOW64\net.exe
net stop "masvc" /y
2⤵
PID:3544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "masvc" /y
3⤵
PID:3404

C:\Windows\SysWOW64\net.exe
net stop "MBAMService" /y
2⤵
PID:3116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBAMService" /y
3⤵
PID:3340

C:\Windows\SysWOW64\net.exe
net stop "MBEndpointAgent" /y
2⤵
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MBEndpointAgent" /y
3⤵
PID:3252

C:\Windows\SysWOW64\net.exe
net stop "McAfeeEngineService" /y
2⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeEngineService" /y
3⤵
PID:4296

C:\Windows\SysWOW64\net.exe
net stop "McAfeeFramework" /y
2⤵
PID:2104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFramework" /y
3⤵
PID:4592

C:\Windows\SysWOW64\net.exe
net stop "McAfeeFrameworkMcAfeeFramework" /y
2⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
3⤵
PID:4308

C:\Windows\SysWOW64\net.exe
net stop "McShield" /y
2⤵
PID:3304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McShield" /y
3⤵
PID:4084

C:\Windows\SysWOW64\net.exe
net stop "McTaskManager" /y
2⤵
PID:208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McTaskManager" /y
3⤵
PID:744

C:\Windows\SysWOW64\net.exe
net stop "mfemms" /y
2⤵
PID:4396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfemms" /y
3⤵
PID:4328

C:\Windows\SysWOW64\net.exe
net stop "mfevtp" /y
2⤵
PID:232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfevtp" /y
3⤵
PID:4836

C:\Windows\SysWOW64\net.exe
net stop "MMS" /y
2⤵
PID:3436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MMS" /y
3⤵
PID:3156

C:\Windows\SysWOW64\net.exe
net stop "mozyprobackup" /y
2⤵
PID:544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mozyprobackup" /y
3⤵
PID:2980

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer" /y
2⤵
PID:3368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer" /y
3⤵
PID:2992

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer100" /y
2⤵
PID:3464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer100" /y
3⤵
PID:3780

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer110" /y
2⤵
PID:2060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer110" /y
3⤵
PID:1472

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeES" /y
2⤵
PID:2240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeES" /y
3⤵
PID:1696

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeIS" /y
2⤵
PID:4780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeIS" /y
3⤵
PID:4132

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeMGMT" /y
2⤵
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
3⤵
PID:3540

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeMTA" /y
2⤵
PID:4640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeMTA" /y
3⤵
PID:4856

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeSA" /y
2⤵
PID:4656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSA" /y
3⤵
PID:4992

C:\Windows\SysWOW64\net.exe
net stop "MSExchangeSRS" /y
2⤵
PID:3424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSExchangeSRS" /y
3⤵
PID:3328

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$SQL_2008" /y
2⤵
PID:4444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
3⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$SYSTEM_BGC" /y
2⤵
PID:2296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
3⤵
PID:4952

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$TPS" /y
2⤵
PID:1424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$TPSAMA" /y
2⤵
PID:4400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
3⤵
PID:3312

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$BKUPEXEC" /y
2⤵
PID:4448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
3⤵
PID:3752

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$ECWDB2" /y
2⤵
PID:4368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
3⤵
PID:460

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PRACTICEMGT" /y
2⤵
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
3⤵
PID:3020

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PRACTTICEBGC" /y
2⤵
PID:1636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
3⤵
PID:4852

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PROFXENGAGEMENT" /y
2⤵
PID:4220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
3⤵
PID:2228

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SBSMONITORING" /y
2⤵
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
3⤵
PID:3124

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SHAREPOINT" /y
2⤵
PID:2532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
3⤵
PID:3548

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SQL_2008" /y
2⤵
PID:920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
3⤵
PID:4480

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SYSTEM_BGC" /y
2⤵
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
3⤵
PID:2960

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$TPS" /y
2⤵
PID:4028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPS" /y
3⤵
PID:3236

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$TPSAMA" /y
2⤵
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
3⤵
PID:800

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:4316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:5036

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2012" /y
2⤵
PID:3628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
3⤵
PID:1040

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher" /y
2⤵
PID:3400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
3⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
2⤵
PID:3200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
3⤵
PID:4964

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SBSMONITORING" /y
2⤵
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
3⤵
PID:4612

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SHAREPOINT" /y
2⤵
PID:664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
3⤵
PID:3708

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SQL_2008" /y
2⤵
PID:1556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
2⤵
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
3⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$TPS" /y
2⤵
PID:1100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
3⤵
PID:4688

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$TPSAMA" /y
2⤵
PID:1320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
3⤵
PID:1224

C:\Windows\SysWOW64\net.exe
net stop "MSSQLSERVER" /y
2⤵
PID:1560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER" /y
3⤵
PID:4264

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerADHelper100" /y
2⤵
PID:4260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
3⤵
PID:3648

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerOLAPService" /y
2⤵
PID:5116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
3⤵
PID:400

C:\Windows\SysWOW64\net.exe
net stop "MySQL80" /y
2⤵
PID:32

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL80" /y
3⤵
PID:4056

C:\Windows\SysWOW64\net.exe
net stop "MySQL57" /y
2⤵
PID:2984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MySQL57" /y
3⤵
PID:1512

C:\Windows\SysWOW64\net.exe
net stop "ntrtscan" /y
2⤵
PID:2212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ntrtscan" /y
3⤵
PID:4512

C:\Windows\SysWOW64\net.exe
net stop "OracleClientCache80" /y
2⤵
PID:2616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OracleClientCache80" /y
3⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop "PDVFSService" /y
2⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "PDVFSService" /y
3⤵
PID:3772

C:\Windows\SysWOW64\net.exe
net stop "POP3Svc" /y
2⤵
PID:4076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "POP3Svc" /y
3⤵
PID:4684

C:\Windows\SysWOW64\net.exe
net stop "ReportServer" /y
2⤵
PID:2640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer" /y
3⤵
PID:224

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$SQL_2008" /y
2⤵
PID:4696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
3⤵
PID:3040

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$SYSTEM_BGC" /y
2⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
3⤵
PID:1816

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$TPS" /y
2⤵
PID:3092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPS" /y
3⤵
PID:4136

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$TPSAMA" /y
2⤵
PID:2116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
3⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net stop "RESvc" /y
2⤵
PID:3076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "RESvc" /y
3⤵
PID:4908

C:\Windows\SysWOW64\net.exe
net stop "sacsvr" /y
2⤵
PID:1080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "sacsvr" /y
3⤵
PID:2428

C:\Windows\SysWOW64\net.exe
net stop "SamSs" /y
2⤵
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SamSs" /y
3⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop "SAVAdminService" /y
2⤵
PID:4844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAVAdminService" /y
3⤵
PID:372

C:\Windows\SysWOW64\net.exe
net stop "SAVService" /y
2⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAVService" /y
3⤵
PID:216

C:\Windows\SysWOW64\net.exe
net stop "SDRSVC" /y
2⤵
PID:3288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SDRSVC" /y
3⤵
PID:3940

C:\Windows\SysWOW64\net.exe
net stop "SepMasterService" /y
2⤵
PID:1068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SepMasterService" /y
3⤵
PID:2380

C:\Windows\SysWOW64\net.exe
net stop "ShMonitor" /y
2⤵
PID:3688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ShMonitor" /y
3⤵
PID:1968

C:\Windows\SysWOW64\net.exe
net stop "Smcinst" /y
2⤵
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Smcinst" /y
3⤵
PID:4840

C:\Windows\SysWOW64\net.exe
net stop "SmcService" /y
2⤵
PID:3276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SmcService" /y
3⤵
PID:1420

C:\Windows\SysWOW64\net.exe
net stop "SMTPSvc" /y
2⤵
PID:1220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SMTPSvc" /y
3⤵
PID:3016

C:\Windows\SysWOW64\net.exe
net stop "SNAC" /y
2⤵
PID:4920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SNAC" /y
3⤵
PID:4532

C:\Windows\SysWOW64\net.exe
net stop "SntpService" /y
2⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SntpService" /y
3⤵
PID:3700

C:\Windows\SysWOW64\net.exe
net stop "sophossps" /y
2⤵
PID:1208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "sophossps" /y
3⤵
PID:2632

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$BKUPEXEC" /y
2⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
3⤵
PID:2160

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$ECWDB2" /y
2⤵
PID:5028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
3⤵
PID:4344

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PRACTTICEBGC" /y
2⤵
PID:2032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
3⤵
PID:4476

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PRACTTICEMGT" /y
2⤵
PID:4004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
3⤵
PID:4164

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PROFXENGAGEMENT" /y
2⤵
PID:2260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
3⤵
PID:1892

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SBSMONITORING" /y
2⤵
PID:2256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
3⤵
PID:424

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SHAREPOINT" /y
2⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
3⤵
PID:2292

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SQL_2008" /y
2⤵
PID:1004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
3⤵
PID:3736

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SYSTEM_BGC" /y
2⤵
PID:3268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
3⤵
PID:3152

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$TPS" /y
2⤵
PID:4536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
3⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$TPSAMA" /y
2⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
3⤵
PID:724

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:4360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:1980

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2012" /y
2⤵
PID:5128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
3⤵
PID:5176

C:\Windows\SysWOW64\net.exe
net stop "SQLBrowser" /y
2⤵
PID:5204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBrowser" /y
3⤵
PID:5260

C:\Windows\SysWOW64\net.exe
net stop "SQLSafeOLRService" /y
2⤵
PID:5292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
3⤵
PID:5352

C:\Windows\SysWOW64\net.exe
net stop "SQLSERVERAGENT" /y
2⤵
PID:5384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
3⤵
PID:5424

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY" /y
2⤵
PID:5460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
3⤵
PID:5556

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY$ECWDB2" /y
2⤵
PID:5584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
3⤵
PID:5632

C:\Windows\SysWOW64\net.exe
net stop "SQLWriter" /y
2⤵
PID:5652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLWriter" /y
3⤵
PID:5708

C:\Windows\SysWOW64\net.exe
net stop "SstpSvc" /y
2⤵
PID:5724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SstpSvc" /y
3⤵
PID:5772

C:\Windows\SysWOW64\net.exe
net stop "svcGenericHost" /y
2⤵
PID:5788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "svcGenericHost" /y
3⤵
PID:5840

C:\Windows\SysWOW64\net.exe
net stop "swi_filter" /y
2⤵
PID:5860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_filter" /y
3⤵
PID:5908

C:\Windows\SysWOW64\net.exe
net stop "swi_service" /y
2⤵
PID:5924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_service" /y
3⤵
PID:5972

C:\Windows\SysWOW64\net.exe
net stop "swi_update_64" /y
2⤵
PID:5988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_update_64" /y
3⤵
PID:6036

C:\Windows\SysWOW64\net.exe
net stop "TmCCSF" /y
2⤵
PID:6052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TmCCSF" /y
3⤵
PID:6100

C:\Windows\SysWOW64\net.exe
net stop "tmlisten" /y
2⤵
PID:6116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "tmlisten" /y
3⤵
PID:4904

C:\Windows\SysWOW64\net.exe
net stop "TrueKey" /y
2⤵
PID:3928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKey" /y
3⤵
PID:5160

C:\Windows\SysWOW64\net.exe
net stop "TrueKeyScheduler" /y
2⤵
PID:5224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
3⤵
PID:5304

C:\Windows\SysWOW64\net.exe
net stop "TrueKeyServiceHelper" /y
2⤵
PID:5340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
3⤵
PID:5404

C:\Windows\SysWOW64\net.exe
net stop "UI0Detect" /y
2⤵
PID:5416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "UI0Detect" /y
3⤵
PID:5496

C:\Windows\SysWOW64\net.exe
net stop "VeeamBackupSvc" /y
2⤵
PID:5596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
3⤵
PID:5720

C:\Windows\SysWOW64\net.exe
net stop "VeeamBrokerSvc" /y
2⤵
PID:5692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
3⤵
PID:5768

C:\Windows\SysWOW64\net.exe
net stop "VeeamCatalogSvc" /y
2⤵
PID:5760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
3⤵
PID:5856

C:\Windows\SysWOW64\net.exe
net stop "VeeamCloudSvc" /y
2⤵
PID:5824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
3⤵
PID:5900

C:\Windows\SysWOW64\net.exe
net stop "VeeamDeploymentService" /y
2⤵
PID:5940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
3⤵
PID:6008

C:\Windows\SysWOW64\net.exe
net stop "VeeamDeploySvc" /y
2⤵
PID:6044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
3⤵
PID:6112

C:\Windows\SysWOW64\net.exe
net stop "VeeamEnterpriseManagerSvc" /y
2⤵
PID:6096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
3⤵
PID:6140

C:\Windows\SysWOW64\net.exe
net stop "VeeamMountSvc" /y
2⤵
PID:5140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamMountSvc" /y
3⤵
PID:5172

C:\Windows\SysWOW64\net.exe
net stop "VeeamNFSSvc" /y
2⤵
PID:5276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
3⤵
PID:5332

C:\Windows\SysWOW64\net.exe
net stop "VeeamRESTSvc" /y
2⤵
PID:5436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
3⤵
PID:5544

C:\Windows\SysWOW64\net.exe
net stop "VeeamTransportSvc" /y
2⤵
PID:5508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
3⤵
PID:5612

C:\Windows\SysWOW64\net.exe
net stop "W3Svc" /y
2⤵
PID:5660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "W3Svc" /y
3⤵
PID:5812

C:\Windows\SysWOW64\net.exe
net stop "wbengine" /y
2⤵
PID:5832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:5888

C:\Windows\SysWOW64\net.exe
net stop "WRSVC" /y
2⤵
PID:5916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "WRSVC" /y
3⤵
PID:5960

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2008R2" /y
2⤵
PID:5948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
3⤵
PID:6068

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2008R2" /y
2⤵
PID:6060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
3⤵
PID:5136

C:\Windows\SysWOW64\net.exe
net stop "VeeamHvIntegrationSvc" /y
2⤵
PID:5148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
3⤵
PID:5408

C:\Windows\SysWOW64\net.exe
net stop "swi_update" /y
2⤵
PID:5288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "swi_update" /y
3⤵
PID:5600

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$CXDB" /y
2⤵
PID:5604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
3⤵
PID:5664

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$CITRIX_METAFRAME" /y
2⤵
PID:5780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
3⤵
PID:5800

C:\Windows\SysWOW64\net.exe
net stop "SQL Backups" /y
2⤵
PID:5884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQL Backups" /y
3⤵
PID:5820

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PROD" /y
2⤵
PID:5932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROD" /y
3⤵
PID:5996

C:\Windows\SysWOW64\net.exe
net stop "Zoolz 2 Service" /y
2⤵
PID:6072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
3⤵
PID:6136

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerADHelper" /y
2⤵
PID:5168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
3⤵
PID:5180

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PROD" /y
2⤵
PID:5480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
3⤵
PID:5644

C:\Windows\SysWOW64\net.exe
net stop "msftesql$PROD" /y
2⤵
PID:5592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "msftesql$PROD" /y
3⤵
PID:5848

C:\Windows\SysWOW64\net.exe
net stop "NetMsmqActivator" /y
2⤵
PID:5736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetMsmqActivator" /y
3⤵
PID:5880

C:\Windows\SysWOW64\net.exe
net stop "EhttpSrv" /y
2⤵
PID:5892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "EhttpSrv" /y
3⤵
PID:6020

C:\Windows\SysWOW64\net.exe
net stop "ekrn" /y
2⤵
PID:4104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ekrn" /y
3⤵
PID:6012

C:\Windows\SysWOW64\net.exe
net stop "ESHASRV" /y
2⤵
PID:5232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ESHASRV" /y
3⤵
PID:5336

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SOPHOS" /y
2⤵
PID:5696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
3⤵
PID:5852

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SOPHOS" /y
2⤵
PID:5240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
3⤵
PID:5896

C:\Windows\SysWOW64\net.exe
net stop "AVP" /y
2⤵
PID:5952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AVP" /y
3⤵
PID:5920

C:\Windows\SysWOW64\net.exe
net stop "klnagent" /y
2⤵
PID:3180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "klnagent" /y
3⤵
PID:5220

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SQLEXPRESS" /y
2⤵
PID:5748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
3⤵
PID:5396

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SQLEXPRESS" /y
2⤵
PID:5756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
3⤵
PID:5964

C:\Windows\SysWOW64\net.exe
net stop "wbengine" /y
2⤵
PID:5732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "wbengine" /y
3⤵
PID:6108

C:\Windows\SysWOW64\net.exe
net stop "kavfsslp" /y
2⤵
PID:5324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "kavfsslp" /y
3⤵
PID:5312

C:\Windows\SysWOW64\net.exe
net stop "KAVFSGT" /y
2⤵
PID:5744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "KAVFSGT" /y
3⤵
PID:5620

C:\Windows\SysWOW64\net.exe
net stop "KAVFS" /y
2⤵
PID:5980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "KAVFS" /y
3⤵
PID:6064

C:\Windows\SysWOW64\net.exe
net stop "mfefire" /y
2⤵
PID:6080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "mfefire" /y
3⤵
PID:6132

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM zoolz.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM agntsvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM dbeng50.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM dbsnmp.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM encsvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6016

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM excel.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM firefoxconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM infopath.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM isqlplussvc.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msaccess.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msftesql.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mspub.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6160

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mydesktopqos.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6220

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mydesktopservice.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6284

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6344

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld-nt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6400

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld-opt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6456

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocautoupds.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6516

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocomm.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6576

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ocssd.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6640

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM onenote.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6700

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM oracle.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6756

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM outlook.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6816

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM powerpnt.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6872

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqbcoreservice.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6976

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlagent.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7112

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlbrowser.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlservr.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6200

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlwriter.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6260

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM steam.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6340

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM synctime.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6372

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM tbirdconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6408

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thebat.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6532

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thebat64.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6592

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM thunderbird.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6684

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM visio.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6748

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM winword.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6796

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM wordpad.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6824

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM xfssvccon.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6880

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM tmlisten.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7156

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM PccNTMon.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6180

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM CNTAoSMgr.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6280

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Ntrtscan.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5144

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mbamtray.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6420

C:\Windows\SysWOW64\cmd.exe
cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
2⤵
PID:3832

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:7440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 364
2⤵
- Program crash
PID:6804

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4236 -ip 4236
1⤵
PID:8092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini
Filesize
488B

MD5
6f39d00abef0334be5f9ca538d389d4c

SHA1
1452dc8c5d5357d354006757dfaa1907f9bfc7c9

SHA256
8e53a7fa3a16b7812a60cf91594318150d60d6fdcaf8005e0d17bdacc7ca022b

SHA512
5d817fb546058a6f697f682ab5d9226979d1ced0770e86ddbc7f930b57db07a0e9994e2f2329b6b5557f9c075ac7631a05e0ee46a5c5d3d81d5cdfdbe9f72fe1

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.MEDUSA
Filesize
623KB

MD5
5c5830e43214338b75cbbf682481ba2d

SHA1
034bb15103e0cf25073a7c33b95f9272c67dddb5

SHA256
667c6f2a037911716f18b5d7bc62e5a67c269cb7a51ad834397fd46d1ce7861d

SHA512
69258b3c0e2fe04cf76374336198be62834ce908e12955f0c1ed6e2d14b55dd5772eac09d4ba17e4e05124434edbf59dad17ef304aa38886d6b3ec9ee3335317

Download Submit
F:\!!!READ_ME_MEDUSA!!!.txt
Filesize
3KB

MD5
2be343feae5834860da93b2f97e3f2f9

SHA1
754011a9158b6648f2fbfc756ae635a1475469b6

SHA256
35e2680fd2cf081f7e9ea24c3afb3ec725a004d4cc318b98a9530cce748b72de

SHA512
bedec6aed27c421e40ed63b4151b7e4f118f890ddab9e33ae692e841d1d99a2235ee414351658a6e60bb5a015c7c787ec1ff21d482781e1f487523913d6e29bd

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads