---
title: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
description: Conti is a ransomware that supposedly inherits its code from Ryuk family and used in targeted attacks against enterprises since December 2019.
canonical_url: https://www.acronis.com/en/blog/posts/conti-ransomware/
locale: en
last_updated: 2026-10-27
---

[Acronis Blog](https://www.acronis.com/en/blog/)
# Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager

Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager before encryption.

[Try Now](https://www.acronis.com/en/products/cloud/trial/)

[![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team")

[Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/)

8 min read

Last updated 15 December 2022

[](https://www.acronis.com/en/blog/posts/conti-ransomware/)Conti ransomware shuts down backup services and unlock files with Windows Restart Manager before encryption

### Summary

*   First seen in December 2019.
*   The average demand for this ransomware is under $100,000. 
*   Uses Windows Restart Manager to close open and unsaved files before encryption.
*   Contains more than 250 strings decryption routines and about 150 services to be terminated.
*   Performs fast file encryption in 32 simultaneous threads using Windows I/O Completion Ports.
*   The ransomware follows the trend and recently has launched the 'Conti.News' data leak site. 

Conti is a ransomware that supposedly inherits its code from Ryuk family and used in targeted attacks against enterprises since December 2019. Recently, Conti operators started the data leak site called ‘Conti.News’ to publish stolen data in case the ransom is not paid. Being a successor of Ryuk ransomware, Conti can be delivered by Trickbot trojans. Conti also implements the Ransomware-as-a-Service model

![Image 3: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/97ebeef069d27f957fea930fe028f841.png)

fylszpcqfel7joif.onion site is created for publishing stolen company’s data.

![Image 4: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/7d7b7a9a205035bc33fc0448df5d7ea4.png)

### Operation modes

The Conti ransomware can be launched with one of the two parameters: ‘-h’ and ‘--encrypt-mode’.

*    ‘--encrypt-mode’ indicates which files are being encrypted, there are 3 possible values: ‘all’, ‘local’, ‘network’. ‘all’ supposes both types of encryption, local and network. Network encryption means to encrypt shared resources inside the local network. By default, ransomware is run with ‘all’ parameters. 
*   ‘-h’ parameter should be run with corresponding filename, where the list of DNS or NetBIOS names of the remote servers is written on which the function NetShareNum() is to execute. By default ‘-h’ is assigned to null, to retrieve information about each shared resource on a current computer.

ProliferationThe ransomware is looking shared resources inside the local network by the local following IP address patterns:

● “172.”

● “192.168”

● “10.”

### Killing services

The ransomware deletes shadow copies of the files and resizes shadowstorages for disks from C: to H: that may also result in shadow copies disappearing.

_cmd.exe /c vssadmin Delete Shadows /all /quiet cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded cmd.exe /c vssadmin Delete Shadows /all /quiet_

The next step is stopping services that belong to SQL, antivirus, and backup and cyber security solutions such as BackupExec and Veeam. It also tries to terminate the Acronis Cyber Protection solution, but fails due to our self protection feature. List contains about 146 services, most of them are SQL databases. The Acronis self-protection technology successfully prevents the backup services from being terminated by the ransomware.

_Acronis VSS Provider_ _Enterprise Client Service_ _SQLsafe Backup Service_ _SQLsafe Filter Service_ _Veeam Backup Catalog Data Service_ _AcronisAgent_ _AcrSch2Svc_ _Antivirus_ _ARSM_ _BackupExecAgentAccelerator_ _BackupExecAgentBrowser_ _BackupExecDeviceMediaService_ _BackupExecJobEngine_ _BackupExecManagementService_ _BackupExecRPCService_ _BackupExecVSSProvider_ _bedbg_ _DCAgent_ _EPSecurityService_ _EPUpdateService_ _EraserSvc11710_ _EsgShKernel_ _FA\_Scheduler_ _IISAdmin_ _IMAP4Svc_ _McShield_ _McTaskManager_ _mfemms_ _mfevtp_ _MMS_ _mozyprobackup_ _MsDtsServer_ _MsDtsServer100_ _MsDtsServer110_ _MSExchangeES_ _MSExchangeIS_ _MSExchangeMGMT_ _MSExchangeMTA_ _MSExchangeSA_ _MSExchangeSRS_ _MSOLAP$SQL\_2008_ _MSOLAP$SYSTEM\_BGC_ _MSOLAP$TPS_ _MSOLAP$TPSAMA_ _MSSQL$BKUPEXEC_

_MSSQL$SBSMONITORING_ _MSSQL$SHAREPOINT_ _MSSQL$SQL\_2008_ _MSSQL$SYSTEM\_BGC_ _MSSQL$TPS_ _MSSQL$TPSAMA_ _MSSQL$VEEAMSQL2008R2_ _MSSQL$VEEAMSQL2012_ _MSSQLFDLauncher_ _MSSQLFDLauncher$PROFXENGAGEMENT_ _MSSQLFDLauncher$SBSMONITORING_ _MSSQLFDLauncher$SHAREPOINT_ _MSSQLFDLauncher$SQL\_2008_ _MSSQLFDLauncher$SYSTEM\_BGC_ _MSSQLFDLauncher$TPS_ _MSSQLFDLauncher$TPSAMA_ _MSSQLSERVER_ _MSSQLServerADHelper100_ _MSSQLServerOLAPService_ _MySQL57_ _ntrtscan_ _OracleClientCache80_ _PDVFSService_ _POP3Svc_ _ReportServer_ _ReportServer$SQL\_2008_ _ReportServer$SYSTEM\_BGC_ _ReportServer$TPS_ _ReportServer$TPSAMA_ _RESvc_ _sacsvr_ _SamSs_ _SAVAdminService_ _SAVService_ _SDRSVC_ _SepMasterService_ _ShMonitor_ _Smcinst_ _SmcService_ _SMTPSvc_ _SQLAgent$BKUPEXEC_ _SQLAgent$ECWDB2_ _SQLAgent$PRACTTICEBGC_ _SQLAgent$PRACTTICEMGT_ _SQLAgent$PROFXENGAGEMENT_ _SQLAgent$SBSMONITORING_ _SQLAgent$SHAREPOINT_ _SQLAgent$SQL\_2008_ _SQLAgent$SYSTEM\_BGC_ _MSSQL$PRACTICEMGT_

_SQLAgent$TPS_ _SQLAgent$TPSAMA_ _SQLAgent$VEEAMSQL2008R2_ _SQLAgent$VEEAMSQL2012_ _SQLBrowser_ _SQLSafeOLRService_ _SQLSERVERAGENT_ _SQLTELEMETRY_ _SQLTELEMETRY$ECWDB2_ _SQLWriter_ _VeeamBackupSvc_ _VeeamBrokerSvc_ _VeeamCatalogSvc_ _VeeamCloudSvc_ _VeeamDeploymentService_ _VeeamDeploySvc_ _VeeamEnterpriseManagerSvc_ _VeeamMountSvc_ _VeeamNFSSvc_ _VeeamRESTSvc_ _VeeamTransportSvc_ _W3Svc_ _wbengine_ _WRSVC_ _MSSQL$VEEAMSQL2008R2_ _SQLAgent$VEEAMSQL2008R2_ _VeeamHvIntegrationSvc_ _swi\_update_ _SQLAgent$CXDB_ _SQLAgent$CITRIX\_METAFRAME_ _SQL Backups_ _MSSQL$PROD_ _Zoolz 2 Service_ _MSSQLServerADHelper_ _SQLAgent$PROD_ _msftesql$PROD_ _NetMsmqActivator_ _EhttpSrv_ _ekrn_ _ESHASRV_ _MSSQL$SOPHOS_ _SQLAgent$SOPHOS_ _AVP_ _klnagent_ _MSSQL$SQLEXPRESS_ _SQLAgent$SQLEXPRESS_ _wbengine_ _mfefire_ _MSSQL$PROFXENGAGEMENT_ _MSSQL$ECWDB2_ _MSSQL$PRACTTICEBGC_

The last step before encryption is terminating SQL-related processes. The predefined “sql” string is matched with the list of the running processes.

![Image 5: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/60965d2ba5a67a04c3378b1a4b87b73f.png)

### Unlocking files

To unlock the currently opened files for encryption, Conti calls Windows Restart Manager to force the files closing. To do that, Conti loads an unusual for malware dynamic linking library rstrtmgr.dll for operating with the Restart Manager service. In short, Restart Manager is responsible for saving and not damaging open and unsaved files before system reboot. It prompts the user to save his data before the system will be shut down. The main feature which is abused by Conti is files unlocking. Before a file will be encrypted, it is checked by the piece of code below, to ensure that file is unlocked and can be closed immediately to prevent the file from being damaged as much as possible.

![Image 6: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/70a77365072cbb03c03384cdd80f5d5d.png)

### Encryption

Conti ransomware uses RSA-4096 and AES-256-CBC encryption algorithms. The embedded public master RSA-4096 key is used for encrypting AES keys generated per file and appending them in the footer of every file.

Conti`s encryption is implemented using Windows I/O Completion Ports to speed up the encryption process by running 32 concurrent threads.

![Image 7: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/891ae987acbfff5e4dd477f83101bd3f.png)

![Image 8: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/393105bda81e9ae672005183a8bccf9d.png)

![Image 9: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/4983d0e663476220bba6919a6f88f514.png)

Lastly, Conti retrieves the result of file encryption using GetQueuedCompletionStatus() and adds the encrypted AES-256-CBC file key to the footer.

The hardcoded master RSA-4096 key is imported from the ‘.data’ section to the Microsoft Cryptographic Provider.

![Image 10: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/d18ebe8636b643d344e2cbf36c731709.png)

![Image 11: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/a48fed82708591c4dd60351e8f900c61.png)

The folders that are ignored during encryption:

_tmp_

_winnt_

_Application Data_

_AppData_

_temp_

_thumb_

_$Recycle.Bin_

_$RECYCLE.BIN_

_System Volume Information_

_Program Files_

_Program Files (x86)_

_Windows_

_Boot_

The file extensions that are skipped by ransomware:

_.exe_

_.dll_

_.lnk_

_.sys_

_.CONTI_

The encrypted files are appended with ‘.CONTI’ extension and look as follows.

![Image 12: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/40f2da5ca29c746f7aacc5594578a2b5.png)

### Ransom note

CONTI leaves a ransom note in every folder to notify a user about infection. It does not generate a user ID and asks to write to one of the email addresses mentioned in the note.

![Image 13: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/0f7448139bd7826045cb7d9a741a7ea7.png)

### Detection by Acronis

Acronis Cyber Protection successfully blocks Conti ransomware with the help of anti-ransomware protection engine and restores encrypted files.

![Image 14: Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://staticfiles.acronis.com/images/content/a0a89bb0124e878a62e8531280523fe2.png)

### IoCs

MD5: c3c8007af12c9bd0c3c53d67b51155b7 SHA256: 8c243545a991a9fae37757f987d7c9d45b34d8a0e7183782742131394fc8922d Mutex =_CONTI_ .CONTI extension CONTI_README.txt flapalinta1950@protonmail.com xersami@protonmail.com

[Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/)  
[Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/)  
[Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/)  
[Malware protection](https://www.acronis.com/en/blog/tags/malware-protection/)  
[Cyberthreats](https://www.acronis.com/en/blog/tags/cyberthreats/)  
[MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/)

## Written by

![Image 15: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)

Acronis Editorial Team

Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments.

[Previous post](https://www.acronis.com/en/blog/posts/shlayer-malware/)  
[Shlayer malware Analysis and Detection](https://www.acronis.com/en/blog/posts/shlayer-malware/)

[Next post](https://www.acronis.com/en/blog/posts/pysa-ransomware/)  
[Threat analysis: Pysa (Mespinoza) ransomware](https://www.acronis.com/en/blog/posts/pysa-ransomware/)

About Acronis

Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.

[Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com)

## Related stories

Want to learn more? Read the latest stories featuring this solution on our blog.

[Acronis Blog](https://www.acronis.com/en/blog/)

![Image 16: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png)

[stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/)

We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain.

**October 26, 2026**3 min read

![Image 17: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png)

[Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/)

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

**October 13, 2026**6 min read

![Image 18: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png)

[Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/)

Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform.

**October 05, 2026**4 min read