A few days ago I installed Honeywell's Enterprise Provisioner, which is used to generate barcodes that are used to configure wireless barcode scanner terminals. I used the program several times with no problems. Today I launched the program, loaded in three saved XML files that store the terminal configuration and the program started to render the data from the XML files. About that time, the program vanished, Malwarebytes popped up and said it had blocked ransomware and wanted to reboot to finish the job. I rebooted and looked at the log, which showed the executable for the program quarantined. I find it hard to believe that there is any ransomware program that targets this particular program, since it is a very uncommon program for anyone to be running on their PC. The file is C:\Honeywell\EnterpriseProvisioner\provisioner.exe
The ransomware name is Malware.Ransom.Agent.Generic
I should mention that my computer also has the Carbon Black endpoint sensor, required by my company, and it detected nothing.
