medusaransomware | c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
Size

624KB
MD5

eb46bc3e2ad88149176ef33c9fea087a
SHA1

a324f02d8fd3f4c4167e7a30123b2c8b5b20ee5a
SHA256

c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4
SHA512

c8c31df31a537c5ae89860d7b3aff0f6ea89d27767b096cb97543b44852256b46ee79e0012190820fde0a53626b2fbc4a7d22c1831eef680d5b59ad73d3250b3
SSDEEP

12288:fNdW6SXebAH9eAoM83HrnLmhdledAxHwwaleIyUm1wJjUpse3NtN6REdsuEUEBNF:nVwRJmVSvGWEQXvvKw4IRRsrWPa1uo

Score

10^/10

medusaransomware credential_access discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

F:\!!!READ_ME_MEDUSA!!!.txt

Ransom Note

$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Dolmor Salon !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. We have penetrated your entire network and researched all about your data. And we have copied all of your confidential data and uploaded to private storage. * You're running a highly valued business and your data was very crucial. 2. We have ENCRYPTED your files. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your critial data to the public and send emails to your competitors. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues. After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 48 hours, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Telegram channel ]-------------------- https://t.me/+lyskiDn9KiYxZjlh --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/ http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/d96ac6bae7c7117b47cc926b0dff683f Backup Mirrors: http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/d96ac6bae7c7117b47cc926b0dff683f --------------------[ Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) ]-------------------- Add user with our tox ID : AEA72DFCF492037A6D15755A74645C7D8E674E342BACA9F9070A3FB74117EC3143FD6E29BEAC Our support email: ( [email protected] ) Company identification hash: f6fe187e91aa40a5658c643cdcadc52fe93879f08b55a2a2e2241a9e77f33118

Emails

[email protected]

URLs

https://t.me/+lyskiDn9KiYxZjlh

http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/

http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/

http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/d96ac6bae7c7117b47cc926b0dff683f

http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/d96ac6bae7c7117b47cc926b0dff683f

Signatures

Medusa Ransomware
Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.
ransomware medusaransomware
Medusaransomware family
medusaransomware
Renames multiple (8869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3442511616-637977696-3186306149-1000-MergedResources-0.pri	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-200.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\3.rsrc	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-200.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-100.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\help.svg	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-16_altform-unplated_contrast-white.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\onenote_whatsnew.xml	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_contrast-white.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Context.Tests.ps1	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-fullcolor.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-60.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_contrast-white.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ExtendedSplashScreen.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20_altform-unplated.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\!!!READ_ME_MEDUSA!!!.txt	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7912	4576	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8120	cmd.exe
8100	PING.EXE

Kills process with taskkill 44 IoCs

defense_evasion

pid	Process
5988	taskkill.exe
6000	taskkill.exe
6540	taskkill.exe
5932	taskkill.exe
6060	taskkill.exe
5212	taskkill.exe
5928	taskkill.exe
6056	taskkill.exe
3128	taskkill.exe
6048	taskkill.exe
5948	taskkill.exe
6312	taskkill.exe
5228	taskkill.exe
6600	taskkill.exe
6668	taskkill.exe
6720	taskkill.exe
6892	taskkill.exe
5980	taskkill.exe
6780	taskkill.exe
5404	taskkill.exe
5704	taskkill.exe
6084	taskkill.exe
5240	taskkill.exe
5352	taskkill.exe
5876	taskkill.exe
5768	taskkill.exe
6040	taskkill.exe
6376	taskkill.exe
5304	taskkill.exe
1484	taskkill.exe
5780	taskkill.exe
6208	taskkill.exe
6428	taskkill.exe
6968	taskkill.exe
5912	taskkill.exe
5936	taskkill.exe
5996	taskkill.exe
5792	taskkill.exe
6836	taskkill.exe
376	taskkill.exe
1492	taskkill.exe
5716	taskkill.exe
6116	taskkill.exe
6488	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{4A2F8B58-DE3A-4FC4-805E-10BC3BB2C0CE}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8100	PING.EXE

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	5876	taskkill.exe
Token: SeDebugPrivilege	5912	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	5240	taskkill.exe
Token: SeDebugPrivilege	5352	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	5932	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	5212	taskkill.exe
Token: SeDebugPrivilege	5936	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	376	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: SeDebugPrivilege	5996	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	5716	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	6000	taskkill.exe
Token: SeDebugPrivilege	6208	taskkill.exe
Token: SeDebugPrivilege	6312	taskkill.exe
Token: SeDebugPrivilege	6376	taskkill.exe
Token: SeDebugPrivilege	6428	taskkill.exe
Token: SeDebugPrivilege	6488	taskkill.exe
Token: SeDebugPrivilege	6540	taskkill.exe
Token: SeDebugPrivilege	6600	taskkill.exe
Token: SeDebugPrivilege	6668	taskkill.exe
Token: SeDebugPrivilege	6720	taskkill.exe
Token: SeDebugPrivilege	6780	taskkill.exe
Token: SeDebugPrivilege	6836	taskkill.exe
Token: SeDebugPrivilege	6892	taskkill.exe
Token: SeDebugPrivilege	6968	taskkill.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe
Token: SeShutdownPrivilege	6692	explorer.exe
Token: SeCreatePagefilePrivilege	6692	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe
6692	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3440	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	83
PID 4576 wrote to memory of 3440	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	83
PID 4576 wrote to memory of 3440	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	83
PID 3440 wrote to memory of 4992	3440	net.exe	85
PID 3440 wrote to memory of 4992	3440	net.exe	85
PID 3440 wrote to memory of 4992	3440	net.exe	85
PID 4576 wrote to memory of 4048	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	86
PID 4576 wrote to memory of 4048	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	86
PID 4576 wrote to memory of 4048	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	86
PID 4048 wrote to memory of 2992	4048	net.exe	88
PID 4048 wrote to memory of 2992	4048	net.exe	88
PID 4048 wrote to memory of 2992	4048	net.exe	88
PID 4576 wrote to memory of 3596	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	89
PID 4576 wrote to memory of 3596	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	89
PID 4576 wrote to memory of 3596	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	89
PID 3596 wrote to memory of 1160	3596	net.exe	91
PID 3596 wrote to memory of 1160	3596	net.exe	91
PID 3596 wrote to memory of 1160	3596	net.exe	91
PID 4576 wrote to memory of 2648	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	92
PID 4576 wrote to memory of 2648	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	92
PID 4576 wrote to memory of 2648	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	92
PID 2648 wrote to memory of 1136	2648	net.exe	94
PID 2648 wrote to memory of 1136	2648	net.exe	94
PID 2648 wrote to memory of 1136	2648	net.exe	94
PID 4576 wrote to memory of 5116	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	95
PID 4576 wrote to memory of 5116	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	95
PID 4576 wrote to memory of 5116	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	95
PID 5116 wrote to memory of 4052	5116	net.exe	97
PID 5116 wrote to memory of 4052	5116	net.exe	97
PID 5116 wrote to memory of 4052	5116	net.exe	97
PID 4576 wrote to memory of 4132	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 4576 wrote to memory of 4132	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 4576 wrote to memory of 4132	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 4132 wrote to memory of 4540	4132	net.exe	100
PID 4132 wrote to memory of 4540	4132	net.exe	100
PID 4132 wrote to memory of 4540	4132	net.exe	100
PID 4576 wrote to memory of 2324	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 4576 wrote to memory of 2324	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 4576 wrote to memory of 2324	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 2324 wrote to memory of 4736	2324	net.exe	103
PID 2324 wrote to memory of 4736	2324	net.exe	103
PID 2324 wrote to memory of 4736	2324	net.exe	103
PID 4576 wrote to memory of 772	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	104
PID 4576 wrote to memory of 772	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	104
PID 4576 wrote to memory of 772	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	104
PID 772 wrote to memory of 1968	772	net.exe	106
PID 772 wrote to memory of 1968	772	net.exe	106
PID 772 wrote to memory of 1968	772	net.exe	106
PID 4576 wrote to memory of 1288	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	107
PID 4576 wrote to memory of 1288	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	107
PID 4576 wrote to memory of 1288	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	107
PID 1288 wrote to memory of 3108	1288	net.exe	109
PID 1288 wrote to memory of 3108	1288	net.exe	109
PID 1288 wrote to memory of 3108	1288	net.exe	109
PID 4576 wrote to memory of 1128	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	110
PID 4576 wrote to memory of 1128	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	110
PID 4576 wrote to memory of 1128	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	110
PID 1128 wrote to memory of 32	1128	net.exe	112
PID 1128 wrote to memory of 32	1128	net.exe	112
PID 1128 wrote to memory of 32	1128	net.exe	112
PID 4576 wrote to memory of 3932	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	113
PID 4576 wrote to memory of 3932	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	113
PID 4576 wrote to memory of 3932	4576	2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe	113
PID 3932 wrote to memory of 3136	3932	net.exe	115

C:\Users\Admin\AppData\Local\Temp\2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\net.exe
  net stop "Acronis VSS Provider" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
    3⤵
    PID:4992
- C:\Windows\SysWOW64\net.exe
  net stop "Enterprise Client Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Enterprise Client Service" /y
    3⤵
    PID:2992
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Agent" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Agent" /y
    3⤵
    PID:1160
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos AutoUpdate Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
    3⤵
    PID:1136
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Clean Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Clean Service" /y
    3⤵
    PID:4052
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Device Control Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
    3⤵
    PID:4540
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos File Scanner Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
    3⤵
    PID:4736
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Health Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Health Service" /y
    3⤵
    PID:1968
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos MCS Agent" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
    3⤵
    PID:3108
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos MCS Client" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos MCS Client" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:32
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Message Router" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Message Router" /y
    3⤵
    PID:3136
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Safestore Service" /y
  2⤵
  PID:3100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
    3⤵
    PID:1916
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos System Protection Service" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
    3⤵
    PID:680
- C:\Windows\SysWOW64\net.exe
  net stop "Sophos Web Control Service" /y
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
    3⤵
    PID:564
- C:\Windows\SysWOW64\net.exe
  net stop "SQLsafe Backup Service" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
    3⤵
    PID:1524
- C:\Windows\SysWOW64\net.exe
  net stop "SQLsafe Filter Service" /y
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
    3⤵
    PID:3228
- C:\Windows\SysWOW64\net.exe
  net stop "Symantec System Recovery" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Symantec System Recovery" /y
    3⤵
    PID:2788
- C:\Windows\SysWOW64\net.exe
  net stop "Veeam Backup Catalog Data Service" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:2296
- C:\Windows\SysWOW64\net.exe
  net stop "AcronisAgent" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AcronisAgent" /y
    3⤵
    PID:392
- C:\Windows\SysWOW64\net.exe
  net stop "AcrSch2Svc" /y
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AcrSch2Svc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496
- C:\Windows\SysWOW64\net.exe
  net stop "Antivirus" /y
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Antivirus" /y
    3⤵
    PID:4676
- C:\Windows\SysWOW64\net.exe
  net stop "ARSM" /y
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ARSM" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:696
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecAgentAccelerator" /y
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:1760
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecAgentBrowser" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
    3⤵
    PID:2028
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecDeviceMediaService" /y
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:5076
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecJobEngine" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
    3⤵
    PID:3268
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecManagementService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecManagementService" /y
    3⤵
    PID:2804
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecRPCService" /y
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecRPCService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
- C:\Windows\SysWOW64\net.exe
  net stop "BackupExecVSSProvider" /y
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
    3⤵
    PID:4516
- C:\Windows\SysWOW64\net.exe
  net stop "bedbg" /y
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "bedbg" /y
    3⤵
    PID:756
- C:\Windows\SysWOW64\net.exe
  net stop "DCAgent" /y
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "DCAgent" /y
    3⤵
    PID:4512
- C:\Windows\SysWOW64\net.exe
  net stop "EPSecurityService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPSecurityService" /y
    3⤵
    PID:560
- C:\Windows\SysWOW64\net.exe
  net stop "EPUpdateService" /y
  2⤵
  PID:544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPUpdateService" /y
    3⤵
    PID:1012
- C:\Windows\SysWOW64\net.exe
  net stop "EraserSvc11710" /y
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EraserSvc11710" /y
    3⤵
    PID:3312
- C:\Windows\SysWOW64\net.exe
  net stop "EsgShKernel" /y
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EsgShKernel" /y
    3⤵
    PID:1764
- C:\Windows\SysWOW64\net.exe
  net stop "FA_Scheduler" /y
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "FA_Scheduler" /y
    3⤵
    PID:3208
- C:\Windows\SysWOW64\net.exe
  net stop "IISAdmin" /y
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "IISAdmin" /y
    3⤵
    PID:4568
- C:\Windows\SysWOW64\net.exe
  net stop "IMAP4Svc" /y
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "IMAP4Svc" /y
    3⤵
    PID:220
- C:\Windows\SysWOW64\net.exe
  net stop "macmnsvc" /y
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "macmnsvc" /y
    3⤵
    PID:1476
- C:\Windows\SysWOW64\net.exe
  net stop "masvc" /y
  2⤵
  PID:3184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "masvc" /y
    3⤵
    PID:4012
- C:\Windows\SysWOW64\net.exe
  net stop "MBAMService" /y
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBAMService" /y
    3⤵
    PID:1132
- C:\Windows\SysWOW64\net.exe
  net stop "MBEndpointAgent" /y
  2⤵
  PID:3280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBEndpointAgent" /y
    3⤵
    PID:4520
- C:\Windows\SysWOW64\net.exe
  net stop "McAfeeEngineService" /y
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeEngineService" /y
    3⤵
    PID:3364
- C:\Windows\SysWOW64\net.exe
  net stop "McAfeeFramework" /y
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeFramework" /y
    3⤵
    PID:3684
- C:\Windows\SysWOW64\net.exe
  net stop "McAfeeFrameworkMcAfeeFramework" /y
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
    3⤵
    PID:1124
- C:\Windows\SysWOW64\net.exe
  net stop "McShield" /y
  2⤵
  PID:212
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McShield" /y
    3⤵
    PID:4584
- C:\Windows\SysWOW64\net.exe
  net stop "McTaskManager" /y
  2⤵
  PID:228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McTaskManager" /y
    3⤵
    PID:4820
- C:\Windows\SysWOW64\net.exe
  net stop "mfemms" /y
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfemms" /y
    3⤵
    PID:1228
- C:\Windows\SysWOW64\net.exe
  net stop "mfevtp" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfevtp" /y
    3⤵
    PID:2184
- C:\Windows\SysWOW64\net.exe
  net stop "MMS" /y
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MMS" /y
    3⤵
    PID:5036
- C:\Windows\SysWOW64\net.exe
  net stop "mozyprobackup" /y
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mozyprobackup" /y
    3⤵
    PID:860
- C:\Windows\SysWOW64\net.exe
  net stop "MsDtsServer" /y
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer" /y
    3⤵
    PID:4748
- C:\Windows\SysWOW64\net.exe
  net stop "MsDtsServer100" /y
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer100" /y
    3⤵
    PID:5096
- C:\Windows\SysWOW64\net.exe
  net stop "MsDtsServer110" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer110" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeES" /y
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeES" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1828
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeIS" /y
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeIS" /y
    3⤵
    PID:1984
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeMGMT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeMTA" /y
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMTA" /y
    3⤵
    PID:2972
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeSA" /y
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4548
- C:\Windows\SysWOW64\net.exe
  net stop "MSExchangeSRS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSRS" /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  net stop "MSOLAP$SQL_2008" /y
  2⤵
  PID:4172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
- C:\Windows\SysWOW64\net.exe
  net stop "MSOLAP$SYSTEM_BGC" /y
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:2428
- C:\Windows\SysWOW64\net.exe
  net stop "MSOLAP$TPS" /y
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
- C:\Windows\SysWOW64\net.exe
  net stop "MSOLAP$TPSAMA" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:1044
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$BKUPEXEC" /y
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:3460
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$ECWDB2" /y
  2⤵
  PID:968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
    3⤵
    PID:60
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$PRACTICEMGT" /y
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:5068
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$PRACTTICEBGC" /y
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:4764
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$PROFXENGAGEMENT" /y
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:1944
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SBSMONITORING" /y
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SHAREPOINT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:3872
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SQL_2008" /y
  2⤵
  PID:4308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
    3⤵
    PID:1816
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SYSTEM_BGC" /y
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    PID:1000
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$TPS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPS" /y
    3⤵
    PID:2128
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$TPSAMA" /y
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
    3⤵
    PID:2900
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$VEEAMSQL2008R2" /y
  2⤵
  PID:2068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:4608
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$VEEAMSQL2012" /y
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:5104
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher" /y
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
    3⤵
    PID:4716
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$SBSMONITORING" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:452
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$SHAREPOINT" /y
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:2340
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$SQL_2008" /y
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:3024
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:4404
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$TPS" /y
  2⤵
  PID:1176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLFDLauncher$TPSAMA" /y
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:3056
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLSERVER" /y
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLServerADHelper100" /y
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
    3⤵
    PID:4972
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLServerOLAPService" /y
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
    3⤵
    PID:1772
- C:\Windows\SysWOW64\net.exe
  net stop "MySQL80" /y
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MySQL80" /y
    3⤵
    PID:3396
- C:\Windows\SysWOW64\net.exe
  net stop "MySQL57" /y
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MySQL57" /y
    3⤵
    PID:904
- C:\Windows\SysWOW64\net.exe
  net stop "ntrtscan" /y
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ntrtscan" /y
    3⤵
    PID:3472
- C:\Windows\SysWOW64\net.exe
  net stop "OracleClientCache80" /y
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OracleClientCache80" /y
    3⤵
    PID:4788
- C:\Windows\SysWOW64\net.exe
  net stop "PDVFSService" /y
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "PDVFSService" /y
    3⤵
    PID:2572
- C:\Windows\SysWOW64\net.exe
  net stop "POP3Svc" /y
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "POP3Svc" /y
    3⤵
    PID:2344
- C:\Windows\SysWOW64\net.exe
  net stop "ReportServer" /y
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- C:\Windows\SysWOW64\net.exe
  net stop "ReportServer$SQL_2008" /y
  2⤵
  PID:828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
    3⤵
    PID:2064
- C:\Windows\SysWOW64\net.exe
  net stop "ReportServer$SYSTEM_BGC" /y
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:4152
- C:\Windows\SysWOW64\net.exe
  net stop "ReportServer$TPS" /y
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2616
- C:\Windows\SysWOW64\net.exe
  net stop "ReportServer$TPSAMA" /y
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
    3⤵
    PID:3516
- C:\Windows\SysWOW64\net.exe
  net stop "RESvc" /y
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "RESvc" /y
    3⤵
    PID:1668
- C:\Windows\SysWOW64\net.exe
  net stop "sacsvr" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "sacsvr" /y
    3⤵
    PID:1448
- C:\Windows\SysWOW64\net.exe
  net stop "SamSs" /y
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:4460
- C:\Windows\SysWOW64\net.exe
  net stop "SAVAdminService" /y
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SAVAdminService" /y
    3⤵
    PID:4268
- C:\Windows\SysWOW64\net.exe
  net stop "SAVService" /y
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SAVService" /y
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  net stop "SDRSVC" /y
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:4072
- C:\Windows\SysWOW64\net.exe
  net stop "SepMasterService" /y
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SepMasterService" /y
    3⤵
    PID:4136
- C:\Windows\SysWOW64\net.exe
  net stop "ShMonitor" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ShMonitor" /y
    3⤵
    PID:4564
- C:\Windows\SysWOW64\net.exe
  net stop "Smcinst" /y
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Smcinst" /y
    3⤵
    PID:2036
- C:\Windows\SysWOW64\net.exe
  net stop "SmcService" /y
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SmcService" /y
    3⤵
    PID:2668
- C:\Windows\SysWOW64\net.exe
  net stop "SMTPSvc" /y
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SMTPSvc" /y
    3⤵
    PID:1512
- C:\Windows\SysWOW64\net.exe
  net stop "SNAC" /y
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SNAC" /y
    3⤵
    PID:648
- C:\Windows\SysWOW64\net.exe
  net stop "SntpService" /y
  2⤵
  PID:3372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SntpService" /y
    3⤵
    PID:2276
- C:\Windows\SysWOW64\net.exe
  net stop "sophossps" /y
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "sophossps" /y
    3⤵
    PID:4372
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$BKUPEXEC" /y
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:5100
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$ECWDB2" /y
  2⤵
  PID:1972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:3152
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$PRACTTICEBGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$PRACTTICEMGT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$PROFXENGAGEMENT" /y
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SBSMONITORING" /y
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:1408
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SHAREPOINT" /y
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
    3⤵
    PID:4168
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SQL_2008" /y
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:3468
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SYSTEM_BGC" /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:5020
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$TPS" /y
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
    3⤵
    PID:4680
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$TPSAMA" /y
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:880
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$VEEAMSQL2008R2" /y
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:3084
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$VEEAMSQL2012" /y
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:3892
- C:\Windows\SysWOW64\net.exe
  net stop "SQLBrowser" /y
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBrowser" /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  net stop "SQLSafeOLRService" /y
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
    3⤵
    PID:2676
- C:\Windows\SysWOW64\net.exe
  net stop "SQLSERVERAGENT" /y
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
    3⤵
    PID:4036
- C:\Windows\SysWOW64\net.exe
  net stop "SQLTELEMETRY" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
    3⤵
    PID:3164
- C:\Windows\SysWOW64\net.exe
  net stop "SQLTELEMETRY$ECWDB2" /y
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
    3⤵
    PID:2692
- C:\Windows\SysWOW64\net.exe
  net stop "SQLWriter" /y
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLWriter" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- C:\Windows\SysWOW64\net.exe
  net stop "SstpSvc" /y
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:3708
- C:\Windows\SysWOW64\net.exe
  net stop "svcGenericHost" /y
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "svcGenericHost" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
- C:\Windows\SysWOW64\net.exe
  net stop "swi_filter" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swi_filter" /y
    3⤵
    PID:5048
- C:\Windows\SysWOW64\net.exe
  net stop "swi_service" /y
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swi_service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- C:\Windows\SysWOW64\net.exe
  net stop "swi_update_64" /y
  2⤵
  PID:708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swi_update_64" /y
    3⤵
    PID:4396
- C:\Windows\SysWOW64\net.exe
  net stop "TmCCSF" /y
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TmCCSF" /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\net.exe
  net stop "tmlisten" /y
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmlisten" /y
    3⤵
    PID:4000
- C:\Windows\SysWOW64\net.exe
  net stop "TrueKey" /y
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TrueKey" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- C:\Windows\SysWOW64\net.exe
  net stop "TrueKeyScheduler" /y
  2⤵
  PID:2052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
    3⤵
    PID:1164
- C:\Windows\SysWOW64\net.exe
  net stop "TrueKeyServiceHelper" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:488
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
    3⤵
    PID:4212
- C:\Windows\SysWOW64\net.exe
  net stop "UI0Detect" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "UI0Detect" /y
    3⤵
    PID:2000
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamBackupSvc" /y
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
    3⤵
    PID:5184
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamBrokerSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
    3⤵
    PID:5248
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamCatalogSvc" /y
  2⤵
  PID:5264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
    3⤵
    PID:5312
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamCloudSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
    3⤵
    PID:5376
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamDeploymentService" /y
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
    3⤵
    PID:5440
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamDeploySvc" /y
  2⤵
  PID:5456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
    3⤵
    PID:5504
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamEnterpriseManagerSvc" /y
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:5568
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamMountSvc" /y
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamMountSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamNFSSvc" /y
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
    3⤵
    PID:5692
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamRESTSvc" /y
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
    3⤵
    PID:5756
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamTransportSvc" /y
  2⤵
  PID:5772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5820
- C:\Windows\SysWOW64\net.exe
  net stop "W3Svc" /y
  2⤵
  PID:5840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "W3Svc" /y
    3⤵
    PID:5888
- C:\Windows\SysWOW64\net.exe
  net stop "wbengine" /y
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:5952
- C:\Windows\SysWOW64\net.exe
  net stop "WRSVC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "WRSVC" /y
    3⤵
    PID:6016
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$VEEAMSQL2008R2" /y
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:6080
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$VEEAMSQL2008R2" /y
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:5128
- C:\Windows\SysWOW64\net.exe
  net stop "VeeamHvIntegrationSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
    3⤵
    PID:5180
- C:\Windows\SysWOW64\net.exe
  net stop "swi_update" /y
  2⤵
  PID:5164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swi_update" /y
    3⤵
    PID:5232
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$CXDB" /y
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$CITRIX_METAFRAME" /y
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
- C:\Windows\SysWOW64\net.exe
  net stop "SQL Backups" /y
  2⤵
  PID:5444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQL Backups" /y
    3⤵
    PID:5468
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$PROD" /y
  2⤵
  PID:5512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROD" /y
    3⤵
    PID:5532
- C:\Windows\SysWOW64\net.exe
  net stop "Zoolz 2 Service" /y
  2⤵
  PID:5544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
    3⤵
    PID:5644
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQLServerADHelper" /y
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
    3⤵
    PID:5664
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$PROD" /y
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
    3⤵
    PID:5736
- C:\Windows\SysWOW64\net.exe
  net stop "msftesql$PROD" /y
  2⤵
  PID:5816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "msftesql$PROD" /y
    3⤵
    PID:5868
- C:\Windows\SysWOW64\net.exe
  net stop "NetMsmqActivator" /y
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "NetMsmqActivator" /y
    3⤵
    PID:5984
- C:\Windows\SysWOW64\net.exe
  net stop "EhttpSrv" /y
  2⤵
  PID:6028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EhttpSrv" /y
    3⤵
    PID:6088
- C:\Windows\SysWOW64\net.exe
  net stop "ekrn" /y
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ekrn" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6140
- C:\Windows\SysWOW64\net.exe
  net stop "ESHASRV" /y
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ESHASRV" /y
    3⤵
    PID:5148
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SOPHOS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
    3⤵
    PID:5252
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SOPHOS" /y
  2⤵
  PID:5292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
- C:\Windows\SysWOW64\net.exe
  net stop "AVP" /y
  2⤵
  PID:5356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AVP" /y
    3⤵
    PID:5472
- C:\Windows\SysWOW64\net.exe
  net stop "klnagent" /y
  2⤵
  PID:5428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "klnagent" /y
    3⤵
    PID:5500
- C:\Windows\SysWOW64\net.exe
  net stop "MSSQL$SQLEXPRESS" /y
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:5680
- C:\Windows\SysWOW64\net.exe
  net stop "SQLAgent$SQLEXPRESS" /y
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:5740
- C:\Windows\SysWOW64\net.exe
  net stop "wbengine" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:5860
- C:\Windows\SysWOW64\net.exe
  net stop "kavfsslp" /y
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "kavfsslp" /y
    3⤵
    PID:6008
- C:\Windows\SysWOW64\net.exe
  net stop "KAVFSGT" /y
  2⤵
  PID:6092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "KAVFSGT" /y
    3⤵
    PID:6136
- C:\Windows\SysWOW64\net.exe
  net stop "KAVFS" /y
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "KAVFS" /y
    3⤵
    PID:5188
- C:\Windows\SysWOW64\net.exe
  net stop "mfefire" /y
  2⤵
  PID:5156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfefire" /y
    3⤵
    PID:5256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM zoolz.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM agntsvc.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM dbeng50.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5876
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM dbsnmp.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5912
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM encsvc.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6084
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM excel.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefoxconfig.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5352
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM infopath.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM isqlplussvc.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msaccess.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msftesql.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mspub.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5212
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mydesktopqos.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mydesktopservice.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mysqld.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mysqld-nt.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mysqld-opt.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM ocautoupds.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM ocomm.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM ocssd.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM onenote.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM oracle.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM outlook.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM powerpnt.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sqbcoreservice.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sqlagent.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sqlbrowser.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sqlservr.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sqlwriter.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM steam.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6116
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM synctime.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM tbirdconfig.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6208
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM thebat.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM thebat64.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6376
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM thunderbird.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6428
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM visio.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6488
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM winword.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6540
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM wordpad.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM xfssvccon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6668
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM tmlisten.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM PccNTMon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6780
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM CNTAoSMgr.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM Ntrtscan.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mbamtray.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\2025-01-25_eb46bc3e2ad88149176ef33c9fea087a_avoslocker_cobalt-strike_luca-stealer.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8120
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 364
  2⤵
  - Program crash
  PID:7912

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4576 -ip 4576
1⤵
PID:7900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini

Filesize
488B

MD5
bc181a425c725fb539eb985b5a829be4

SHA1
c4f27dc87d4b218106bfc84b245a51e09b4586d7

SHA256
b45ebef446c0a9d76d64fea172b9ccaaa247688f01d418e6e69f725fc40badd2

SHA512
b547810ac53510a0d426afe2c23df0cb79d4e3dbb702dec9f7886a756b27220a3b99c2a5a216f63735090cf44dfbc335d46baef509694283e8c87bb73e3e7215

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.MEDUSA

Filesize
623KB

MD5
0140821dad82838ff615c9597679a603

SHA1
162e292d9a35aba3984d4af1f22201e7cdfbf9f7

SHA256
3f900d195ac3a5395effda3cecf18676582824e6d3e3afaf5dd169adb99def95

SHA512
a3e1434d6fcbe96968256af806b3180cfc025e86a1887ac47eddf7b2bf30dd1411d9bfd3d3318f6b92241ab6a7f7e52e0f488b39b9b8be768cdf906aa52a89dd

Download Submit
F:\!!!READ_ME_MEDUSA!!!.txt

Filesize
3KB

MD5
8dcba16df7e42efb90843bd185d579c3

SHA1
6e89f25f2faa66cebeeb3ecc5d41e2a426764bd5

SHA256
10019fbea76c4c5cf440a25905e574d651e884b224faf29d8bf34ed52f323c0f

SHA512
928b26fad4086f80e2af2a795108566694126ab50b5ba719316d5d53fc6ca8f77f8718b2037ea434eddd61b9493209de2109a4e4c9e776594ebde9d8f4cec384

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads