Malware Analysis Report

2024-10-19 00:02

Sample ID 201104-8w71ws11hn
Target BadRabbit.bin.zip
SHA256 34846131fbf83a71a20dfe4b12d68adb2b764dec18e13a26f6af5b107336616c
Tags
badrabbit ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34846131fbf83a71a20dfe4b12d68adb2b764dec18e13a26f6af5b107336616c

Threat Level: Known bad

The file BadRabbit.bin.zip was found to be: Known bad.

Malicious Activity Summary

badrabbit ransomware

BadRabbit

Executes dropped EXE

Modifies extensions of user files

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-11-04 03:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-11-04 03:35

Reported

2020-11-04 03:38

Platform

win7v20201028

Max time kernel

150s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe"

Signatures

BadRabbit

ransomware badrabbit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\197A.tmp N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\197A.tmp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\infpub.dat C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe N/A
File opened for modification C:\Windows\infpub.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\cscc.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\dispci.exe C:\Windows\SysWOW64\rundll32.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\197A.tmp N/A
N/A N/A C:\Windows\197A.tmp N/A
N/A N/A C:\Windows\197A.tmp N/A
N/A N/A C:\Windows\197A.tmp N/A
N/A N/A C:\Windows\197A.tmp N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\197A.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1848 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 1160 wrote to memory of 1440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 1440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 1440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 1440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1440 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1440 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1440 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1160 wrote to memory of 752 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 752 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 752 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 752 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 752 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1160 wrote to memory of 320 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 320 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 320 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 320 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1160 wrote to memory of 1172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\197A.tmp
PID 1160 wrote to memory of 1172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\197A.tmp
PID 1160 wrote to memory of 1172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\197A.tmp
PID 1160 wrote to memory of 1172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\197A.tmp
PID 320 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe

"C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Delete /F /TN rhaegal

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /F /TN rhaegal

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1770005381 && exit"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1770005381 && exit"

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 03:50:00

C:\Windows\197A.tmp

"C:\Windows\197A.tmp" \\.\pipe\{6CC80334-FF2A-44E6-B28A-399425B92468}

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 03:50:00

Network

Country Destination Domain Proto
N/A 10.7.0.0:445 tcp
N/A 10.7.0.0:139 tcp
N/A 10.7.0.1:445 tcp
N/A 10.7.0.1:139 tcp
N/A 10.7.0.2:445 tcp
N/A 10.7.0.2:139 tcp
N/A 10.7.0.3:445 tcp
N/A 10.7.0.3:139 tcp
N/A 10.7.0.4:445 tcp
N/A 10.7.0.4:139 tcp
N/A 10.7.0.5:445 tcp
N/A 10.7.0.5:139 tcp
N/A 10.7.0.6:445 tcp
N/A 10.7.0.6:139 tcp
N/A 10.7.0.7:445 tcp
N/A 10.7.0.7:139 tcp
N/A 10.7.0.8:445 tcp
N/A 10.7.0.8:139 tcp
N/A 10.7.0.9:445 tcp
N/A 10.7.0.9:139 tcp
N/A 10.7.0.10:445 tcp
N/A 10.7.0.10:139 tcp
N/A 10.7.0.11:445 tcp
N/A 10.7.0.11:139 tcp
N/A 10.7.0.12:445 tcp
N/A 10.7.0.12:139 tcp
N/A 10.7.0.13:445 tcp
N/A 10.7.0.13:139 tcp
N/A 10.7.0.14:445 tcp
N/A 10.7.0.14:139 tcp
N/A 10.7.0.15:445 tcp
N/A 10.7.0.15:139 tcp
N/A 10.7.0.16:445 tcp
N/A 10.7.0.16:139 tcp
N/A 10.7.0.17:445 tcp
N/A 10.7.0.17:139 tcp
N/A 10.7.0.18:445 tcp
N/A 10.7.0.18:139 tcp
N/A 10.7.0.19:445 tcp
N/A 10.7.0.19:139 tcp
N/A 10.7.0.20:445 tcp
N/A 10.7.0.20:139 tcp
N/A 10.7.0.21:445 tcp
N/A 10.7.0.21:139 tcp
N/A 10.7.0.22:445 tcp
N/A 10.7.0.22:139 tcp
N/A 10.7.0.23:445 tcp
N/A 10.7.0.23:139 tcp
N/A 10.7.0.24:445 tcp
N/A 10.7.0.24:139 tcp
N/A 10.7.0.25:445 tcp
N/A 10.7.0.25:139 tcp
N/A 10.7.0.26:445 tcp
N/A 10.7.0.26:139 tcp
N/A 10.7.0.27:445 tcp
N/A 10.7.0.27:139 tcp
N/A 10.7.0.28:445 tcp
N/A 10.7.0.28:139 tcp
N/A 10.7.0.29:445 tcp
N/A 10.7.0.29:139 tcp
N/A 10.7.0.30:445 tcp
N/A 10.7.0.30:139 tcp
N/A 10.7.0.31:445 tcp
N/A 10.7.0.31:139 tcp
N/A 10.7.0.32:445 tcp
N/A 10.7.0.32:139 tcp
N/A 10.7.0.33:445 tcp
N/A 10.7.0.33:139 tcp
N/A 10.7.0.34:445 tcp
N/A 10.7.0.34:139 tcp
N/A 10.7.0.35:445 tcp

Files

memory/1160-0-0x0000000000000000-mapping.dmp

C:\Windows\infpub.dat

MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

memory/1160-2-0x00000000009A0000-0x0000000000A08000-memory.dmp

memory/1440-3-0x0000000000000000-mapping.dmp

memory/1980-4-0x0000000000000000-mapping.dmp

memory/752-5-0x0000000000000000-mapping.dmp

memory/1668-6-0x0000000000000000-mapping.dmp

memory/320-7-0x0000000000000000-mapping.dmp

memory/1172-8-0x0000000000000000-mapping.dmp

memory/628-9-0x0000000000000000-mapping.dmp

C:\Windows\197A.tmp

MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Analysis: behavioral2

Detonation Overview

Submitted

2020-11-04 03:35

Reported

2020-11-04 03:38

Platform

win10v20201028

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe"

Signatures

BadRabbit

ransomware badrabbit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\7843.tmp N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\FindAssert.tiff C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Users\Admin\Pictures\MergeRequest.tiff C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\infpub.dat C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe N/A
File opened for modification C:\Windows\infpub.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\cscc.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\dispci.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\7843.tmp C:\Windows\SysWOW64\rundll32.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\7843.tmp N/A
N/A N/A C:\Windows\7843.tmp N/A
N/A N/A C:\Windows\7843.tmp N/A
N/A N/A C:\Windows\7843.tmp N/A
N/A N/A C:\Windows\7843.tmp N/A
N/A N/A C:\Windows\7843.tmp N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\7843.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 636 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 636 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe C:\Windows\SysWOW64\rundll32.exe
PID 4040 wrote to memory of 3728 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 3728 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 3728 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3728 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3728 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4040 wrote to memory of 200 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 200 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 200 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 200 wrote to memory of 3120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 200 wrote to memory of 3120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 200 wrote to memory of 3120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4040 wrote to memory of 3840 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 3840 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 3840 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 4040 wrote to memory of 2640 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\7843.tmp
PID 4040 wrote to memory of 2640 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\7843.tmp
PID 3840 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3840 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3840 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe

"C:\Users\Admin\AppData\Local\Temp\BadRabbit.bin.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Delete /F /TN rhaegal

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /F /TN rhaegal

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 365958471 && exit"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 365958471 && exit"

C:\Windows\SysWOW64\cmd.exe

/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 04:50:00

C:\Windows\7843.tmp

"C:\Windows\7843.tmp" \\.\pipe\{11B9693A-CBBE-4D5E-ADD3-146148832D41}

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 04:50:00

Network

Country Destination Domain Proto
N/A 13.107.42.23:445 config.edge.skype.com tcp
N/A 10.10.0.33:445 tcp
N/A 10.10.0.29:445 tcp
N/A 52.109.76.31:445 nexusrules.officeapps.live.com tcp
N/A 104.81.140.70:445 fs.microsoft.com tcp
N/A 10.10.0.1:445 tcp
N/A 10.10.0.0:445 tcp
N/A 10.10.0.29:139 tcp
N/A 10.10.0.1:139 tcp
N/A 104.81.140.70:139 fs.microsoft.com tcp
N/A 13.107.42.23:139 config.edge.skype.com tcp
N/A 52.109.76.31:139 nexusrules.officeapps.live.com tcp
N/A 10.10.0.33:139 tcp
N/A 10.10.0.0:139 tcp
N/A 10.10.0.1:445 tcp
N/A 10.10.0.1:139 tcp
N/A 10.10.0.2:445 tcp
N/A 10.10.0.2:139 tcp
N/A 10.10.0.3:445 tcp
N/A 10.10.0.3:139 tcp
N/A 10.10.0.4:445 tcp
N/A 10.10.0.4:139 tcp
N/A 10.10.0.5:445 tcp
N/A 10.10.0.5:139 tcp
N/A 10.10.0.6:445 tcp
N/A 10.10.0.6:139 tcp
N/A 10.10.0.7:445 tcp
N/A 10.10.0.7:139 tcp
N/A 10.10.0.8:445 tcp
N/A 10.10.0.8:139 tcp
N/A 10.10.0.9:445 tcp
N/A 10.10.0.9:139 tcp
N/A 10.10.0.10:445 tcp
N/A 10.10.0.10:139 tcp
N/A 10.10.0.11:445 tcp
N/A 10.10.0.11:139 tcp
N/A 10.10.0.12:445 tcp
N/A 10.10.0.12:139 tcp
N/A 10.10.0.13:445 tcp
N/A 10.10.0.13:139 tcp
N/A 10.10.0.14:445 tcp
N/A 10.10.0.14:139 tcp
N/A 10.10.0.15:445 tcp
N/A 10.10.0.15:139 tcp
N/A 10.10.0.16:445 tcp
N/A 10.10.0.16:139 tcp
N/A 10.10.0.17:445 tcp
N/A 10.10.0.17:139 tcp
N/A 10.10.0.18:445 tcp
N/A 10.10.0.18:139 tcp
N/A 10.10.0.19:445 tcp
N/A 10.10.0.19:139 tcp
N/A 10.10.0.20:445 tcp
N/A 10.10.0.20:139 tcp
N/A 10.10.0.21:445 tcp
N/A 10.10.0.21:139 tcp
N/A 10.10.0.22:445 tcp
N/A 10.10.0.22:139 tcp
N/A 10.10.0.23:445 tcp
N/A 10.10.0.23:139 tcp
N/A 10.10.0.24:445 tcp
N/A 10.10.0.24:139 tcp
N/A 10.10.0.25:445 tcp
N/A 10.10.0.25:139 tcp
N/A 10.10.0.26:445 tcp
N/A 10.10.0.26:139 tcp
N/A 10.10.0.27:445 tcp
N/A 10.10.0.27:139 tcp
N/A 10.10.0.28:445 tcp
N/A 10.10.0.28:139 tcp
N/A 10.10.0.29:445 tcp
N/A 10.10.0.29:139 tcp
N/A 10.10.0.30:445 tcp
N/A 10.10.0.30:139 tcp
N/A 10.10.0.31:445 tcp
N/A 10.10.0.31:139 tcp
N/A 10.10.0.32:445 tcp
N/A 10.10.0.32:139 tcp
N/A 10.10.0.33:445 tcp
N/A 10.10.0.33:139 tcp
N/A 10.10.0.34:445 tcp
N/A 10.10.0.34:139 tcp
N/A 10.10.0.35:445 tcp
N/A 10.10.0.35:139 tcp
N/A 10.10.0.36:445 tcp

Files

memory/4040-0-0x0000000000000000-mapping.dmp

C:\Windows\infpub.dat

MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

memory/4040-2-0x0000000000BB0000-0x0000000000C18000-memory.dmp

memory/3728-3-0x0000000000000000-mapping.dmp

memory/3712-4-0x0000000000000000-mapping.dmp

memory/200-5-0x0000000000000000-mapping.dmp

memory/3120-6-0x0000000000000000-mapping.dmp

memory/3840-7-0x0000000000000000-mapping.dmp

memory/2640-8-0x0000000000000000-mapping.dmp

C:\Windows\7843.tmp

MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

memory/1172-10-0x0000000000000000-mapping.dmp

C:\Windows\7843.tmp

MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787