Malware Analysis Report

2025-01-18 20:23

Sample ID 220130-jvsrsshbbp
Target 16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193
SHA256 16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193
Tags
$2a$10$obr3pd3h0pu0x8b7l5rzzeda/z5cscmwurdrvw91q237rpetehrlu 7047 sodinokibi ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193

Threat Level: Known bad

The file 16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193 was found to be: Known bad.

Malicious Activity Summary

$2a$10$obr3pd3h0pu0x8b7l5rzzeda/z5cscmwurdrvw91q237rpetehrlu 7047 sodinokibi ransomware

Sodinokibi family

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-30 07:59

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-30 07:59

Reported

2022-01-30 08:02

Platform

win7-en-20211208

Max time kernel

117s

Max time network

135s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UnpublishReset.raw => \??\c:\users\admin\pictures\UnpublishReset.raw.0pa6980309 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\FormatProtect.tif => \??\c:\users\admin\pictures\FormatProtect.tif.0pa6980309 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\SwitchConvert.raw => \??\c:\users\admin\pictures\SwitchConvert.raw.0pa6980309 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\FormatSplit.crw => \??\c:\users\admin\pictures\FormatSplit.crw.0pa6980309 C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\D: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\regsvr32.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3t4jibieh65.bmp" C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ProtectLimit.sql C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ResumeDisconnect.ttc C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\TraceDisconnect.dib C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\WriteRequest.cfg C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files\0pa6980309-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SetSwitch.clr C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SplitUndo.MTS C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files (x86)\0pa6980309-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\DisconnectRename.jtx C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExportCopy.asf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\MergeGroup.3gp C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\WaitNew.mpp C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\MountRepair.wmf C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\0pa6980309-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\WaitReceive.pps C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\AssertApprove.pps C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\BackupSubmit.html C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\DismountConnect.dib C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\FormatSync.mpv2 C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\PingConnect.3gpp C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\LockCompress.html C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SendMount.vssx C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\UnlockSync.jpeg C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\UpdateRevoke.png C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\0pa6980309-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\EditNew.tif C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExitWait.wm C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\RevokeExport.vdw C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SplitRename.m4v C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SubmitWatch.mpeg3 C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExitUse.vsdx C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\MoveLimit.php C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\PublishInvoke.edrwx C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\0pa6980309-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1720 wrote to memory of 1884 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

memory/1720-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

memory/1884-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-30 07:59

Reported

2022-01-30 08:02

Platform

win10-en-20211208

Max time kernel

155s

Max time network

129s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\users\admin\pictures\DebugTrace.tiff C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\users\admin\pictures\CopyUndo.tiff C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\users\admin\pictures\UnregisterRestore.tiff C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.94kpkghj09 C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\D: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\regsvr32.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\AssertOptimize.rmi C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ConvertProtect.fon C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\FindMount.fon C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\MountInvoke.jtx C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ResetRedo.rtf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\UnblockApprove.xla C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\DebugMove.avi C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\InvokeStep.jpeg C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\LimitGrant.vbs C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\OutGrant.i64 C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files\94kpkghj09-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ReceiveRegister.M2TS C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\RestoreNew.aif C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\RevokeProtect.dxf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SetInstall.dxf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SuspendBlock.ods C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\EnablePing.ex_ C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExitRestart.odp C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\AddDisconnect.midi C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\InitializeConvert.3gpp C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\LockDisable.dot C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\RenameConvertTo.pot C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExpandCheckpoint.xml C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\MeasureMerge.ex_ C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\OptimizeMeasure.m1v C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ReadSkip.mid C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\StepResolve.scf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\UnregisterClear.potm C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ConvertToExpand.raw C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExportConnect.asf C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\SkipEnable.fon C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\WatchEnable.TTS C:\Windows\SysWOW64\regsvr32.exe N/A
File created \??\c:\program files (x86)\94kpkghj09-readme.txt C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ConnectUnlock.xht C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\ExpandRestart.avi C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification \??\c:\program files\TraceSet.3gp2 C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 3064 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2692 wrote to memory of 3064 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2692 wrote to memory of 3064 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
NL 52.109.88.44:443 tcp

Files

N/A