Malware Analysis Report

2025-01-18 18:34

Sample ID 220211-cg5qwabcal
Target 6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0
SHA256 6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0
Tags
sodinokibi $2a$10$shx1lba3xaa/xqxdig7wberlscl.wfmi0h1w9xk4tryyiedsonlrc 3597 persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0

Threat Level: Known bad

The file 6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0 was found to be: Known bad.

Malicious Activity Summary

sodinokibi $2a$10$shx1lba3xaa/xqxdig7wberlscl.wfmi0h1w9xk4tryyiedsonlrc 3597 persistence ransomware

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Adds Run key to start application

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-11 02:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-11 02:03

Reported

2022-02-11 02:06

Platform

win7-en-20211208

Max time kernel

131s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ConvertStop.raw => \??\c:\users\admin\pictures\ConvertStop.raw.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectUpdate.raw => \??\c:\users\admin\pictures\DisconnectUpdate.raw.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\InvokeExit.tiff => \??\c:\users\admin\pictures\InvokeExit.tiff.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectDeny.raw => \??\c:\users\admin\pictures\ProtectDeny.raw.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\ReadSwitch.crw => \??\c:\users\admin\pictures\ReadSwitch.crw.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\UninstallExpand.tif => \??\c:\users\admin\pictures\UninstallExpand.tif.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\users\admin\pictures\InvokeExit.tiff C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromRename.png => \??\c:\users\admin\pictures\ConvertFromRename.png.uf3ab144m C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe" C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\675n7r0.bmp" C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\DisableSearch.3gpp C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\InstallConvertFrom.mp4v C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\MergeUnlock.nfo C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\PingHide.xltm C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SaveExpand.wpl C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\WriteUnpublish.cr2 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files\uf3ab144m-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\AssertUse.tif C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\DisconnectGrant.ttf C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\PushTrace.gif C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ReadPop.doc C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\UnregisterBlock.pub C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files (x86)\uf3ab144m-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\CompressAssert.iso C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\DisableRequest.cr2 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SubmitWatch.vdx C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\uf3ab144m-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\uf3ab144m-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\FindRemove.vdx C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\PushOpen.3gp2 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SwitchStep.scf C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\UpdateFind.dwfx C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\uf3ab144m-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d0c8baa4eb1ed801 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe

"C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rieed.de udp
US 8.8.8.8:53 wmiadmin.com udp
US 172.67.173.152:443 wmiadmin.com tcp
US 8.8.8.8:53 cwsitservices.co.uk udp
GB 35.214.77.27:443 cwsitservices.co.uk tcp
GB 35.214.77.27:443 cwsitservices.co.uk tcp
US 8.8.8.8:53 tanzprojekt.com udp
FR 5.175.14.11:443 tanzprojekt.com tcp
FR 5.175.14.11:443 tanzprojekt.com tcp
US 8.8.8.8:53 aselbermachen.com udp
CA 172.105.27.61:443 aselbermachen.com tcp
US 8.8.8.8:53 drnice.de udp
DE 78.47.54.3:443 drnice.de tcp
US 8.8.8.8:53 adoptioperheet.fi udp
FI 95.217.160.242:443 adoptioperheet.fi tcp
FI 95.217.160.242:443 adoptioperheet.fi tcp
US 8.8.8.8:53 henricekupper.com udp
GB 78.129.239.42:443 henricekupper.com tcp
GB 78.129.239.42:443 henricekupper.com tcp
US 8.8.8.8:53 christinarebuffetcourses.com udp
DE 35.242.240.46:443 christinarebuffetcourses.com tcp
DE 35.242.240.46:443 christinarebuffetcourses.com tcp
US 8.8.8.8:53 nvwoodwerks.com udp
US 188.114.97.0:443 nvwoodwerks.com tcp
US 8.8.8.8:53 nvwoodworks.com udp
US 188.114.96.0:443 nvwoodworks.com tcp
US 8.8.8.8:53 resinwerksstudio.com udp
CA 23.227.38.65:443 resinwerksstudio.com tcp
CA 23.227.38.65:443 resinwerksstudio.com tcp
US 8.8.8.8:53 facettenreich27.de udp
ES 185.107.227.241:443 facettenreich27.de tcp
US 8.8.8.8:53 craigvalentineacademy.com udp
US 35.208.53.255:443 craigvalentineacademy.com tcp
US 35.208.53.255:443 craigvalentineacademy.com tcp
US 8.8.8.8:53 turkcaparbariatrics.com udp
TR 178.157.8.3:443 turkcaparbariatrics.com tcp
US 8.8.8.8:53 fizzl.ru udp
LV 91.194.76.170:443 fizzl.ru tcp
US 8.8.8.8:53 ontrailsandboulevards.com udp
BG 194.1.147.60:443 ontrailsandboulevards.com tcp
BG 194.1.147.60:443 ontrailsandboulevards.com tcp
US 8.8.8.8:53 ora-it.de udp
FR 176.28.10.103:443 ora-it.de tcp
US 8.8.8.8:53 www.ora-it.de udp
FR 176.28.10.103:443 www.ora-it.de tcp
US 8.8.8.8:53 monark.com udp
US 13.248.155.104:443 monark.com tcp
US 13.248.155.104:443 monark.com tcp
US 8.8.8.8:53 visiativ-industry.fr udp
FR 51.68.244.60:443 visiativ-industry.fr tcp
US 8.8.8.8:53 www.visiativ-solutions.fr udp
FR 51.68.244.60:443 www.visiativ-solutions.fr tcp
FR 51.68.244.60:443 www.visiativ-solutions.fr tcp
US 8.8.8.8:53 gasbarre.com udp
US 104.26.13.67:443 gasbarre.com tcp
US 8.8.8.8:53 vibethink.net udp
US 188.114.97.0:443 vibethink.net tcp
US 8.8.8.8:53 gaiam.nl udp
DE 78.46.9.130:443 gaiam.nl tcp
US 8.8.8.8:53 www.flowfitness.com udp
US 172.67.73.175:443 www.flowfitness.com tcp
US 8.8.8.8:53 kevinjodea.com udp
HK 47.75.130.171:443 kevinjodea.com tcp
US 8.8.8.8:53 lynsayshepherd.co.uk udp
US 199.250.197.4:443 lynsayshepherd.co.uk tcp
US 199.250.197.4:443 lynsayshepherd.co.uk tcp
US 8.8.8.8:53 zieglerbrothers.de udp
DE 178.254.34.29:443 zieglerbrothers.de tcp
DE 178.254.34.29:443 zieglerbrothers.de tcp
US 8.8.8.8:53 ravensnesthomegoods.com udp
US 8.8.8.8:53 xtptrack.com udp
NL 35.204.74.76:443 xtptrack.com tcp
NL 35.204.74.76:443 xtptrack.com tcp
US 8.8.8.8:53 airconditioning-waalwijk.nl udp
NL 37.97.136.110:443 airconditioning-waalwijk.nl tcp
NL 37.97.136.110:443 airconditioning-waalwijk.nl tcp
US 8.8.8.8:53 candyhouseusa.com udp
DE 85.214.77.144:443 candyhouseusa.com tcp
US 8.8.8.8:53 admos-gleitlager.de udp
DE 81.169.145.149:443 admos-gleitlager.de tcp
DE 81.169.145.149:443 admos-gleitlager.de tcp
US 8.8.8.8:53 navyfederalautooverseas.com udp
US 52.20.75.117:443 navyfederalautooverseas.com tcp
US 8.8.8.8:53 rozemondcoaching.nl udp
US 104.21.10.44:443 rozemondcoaching.nl tcp
US 8.8.8.8:53 transliminaltribe.wordpress.com udp
US 192.0.78.13:443 transliminaltribe.wordpress.com tcp
US 192.0.78.13:443 transliminaltribe.wordpress.com tcp
US 8.8.8.8:53 vannesteconstruct.be udp
DK 46.30.215.75:443 vannesteconstruct.be tcp
DK 46.30.215.75:443 vannesteconstruct.be tcp
US 8.8.8.8:53 theclubms.com udp
IE 54.247.91.90:443 theclubms.com tcp
IE 54.247.91.90:443 theclubms.com tcp
US 8.8.8.8:53 makeflowers.ru udp
RU 23.111.202.89:443 makeflowers.ru tcp
RU 23.111.202.89:443 makeflowers.ru tcp
US 8.8.8.8:53 ogdenvision.com udp
US 66.228.32.51:443 ogdenvision.com tcp
US 66.228.32.51:443 ogdenvision.com tcp
US 8.8.8.8:53 sterlingessay.com udp
FR 163.172.69.13:443 sterlingessay.com tcp

Files

memory/1452-53-0x0000000002F4A000-0x0000000002F6A000-memory.dmp

memory/1452-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

memory/1452-56-0x00000000049D0000-0x0000000004A6F000-memory.dmp

memory/1452-57-0x0000000004BA0000-0x0000000004CCD000-memory.dmp

memory/1452-58-0x00000000003A0000-0x00000000003BF000-memory.dmp

memory/1452-59-0x0000000004FC0000-0x00000000050C9000-memory.dmp

memory/1452-60-0x0000000002F4A000-0x0000000002F6A000-memory.dmp

memory/1452-61-0x0000000000220000-0x000000000024B000-memory.dmp

memory/1452-62-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1452-64-0x0000000000260000-0x0000000000261000-memory.dmp

memory/1452-63-0x0000000000250000-0x000000000025A000-memory.dmp

memory/1452-65-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1452-66-0x0000000000280000-0x0000000000281000-memory.dmp

memory/1452-67-0x00000000002E0000-0x00000000002E6000-memory.dmp

memory/1208-68-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

memory/1208-71-0x0000000002010000-0x0000000002012000-memory.dmp

memory/1208-70-0x000007FEF5B0E000-0x000007FEF5B0F000-memory.dmp

memory/1208-72-0x0000000002012000-0x0000000002014000-memory.dmp

memory/1208-73-0x0000000002014000-0x0000000002017000-memory.dmp

memory/1208-69-0x000007FEF33E0000-0x000007FEF3F3D000-memory.dmp

memory/1208-74-0x000000000201B000-0x000000000203A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-11 02:03

Reported

2022-02-11 02:06

Platform

win10v2004-en-20220113

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification \??\c:\users\admin\pictures\ConvertFromRevoke.tiff C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\users\admin\pictures\RevokeStop.tiff C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\CompleteClose.tif => \??\c:\users\admin\pictures\CompleteClose.tif.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromRevoke.tiff => \??\c:\users\admin\pictures\ConvertFromRevoke.tiff.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\RemoveConfirm.raw => \??\c:\users\admin\pictures\RemoveConfirm.raw.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendMeasure.tiff => \??\c:\users\admin\pictures\SuspendMeasure.tiff.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\users\admin\pictures\SuspendMeasure.tiff C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\CompareReceive.crw => \??\c:\users\admin\pictures\CompareReceive.crw.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\CompleteExport.raw => \??\c:\users\admin\pictures\CompleteExport.raw.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\RevokeStop.tiff => \??\c:\users\admin\pictures\RevokeStop.tiff.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendSelect.tif => \??\c:\users\admin\pictures\SuspendSelect.tif.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\SubmitExport.tif => \??\c:\users\admin\pictures\SubmitExport.tif.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File renamed C:\Users\Admin\Pictures\SyncUpdate.tif => \??\c:\users\admin\pictures\SyncUpdate.tif.3uems08bv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe" C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\183bg8v.bmp" C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\AssertClose.mp3 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ExitCopy.dib C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SaveWrite.3gp C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SyncRead.rmi C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\WatchReset.mpg C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\WatchTrace.xla C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\CheckpointTest.ADT C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\EnterRequest.aiff C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\NewRepair.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ProtectPop.TTS C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\PublishUnprotect.aif C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SaveMerge.wdp C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SwitchDisable.shtml C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\NewResume.docx C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SelectClose.csv C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SetConvert.7z C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\TraceReset.emf C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\EnableConnect.mpe C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\MergeWatch.WTV C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files\3uems08bv-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\EnableAdd.css C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ExitMerge.jpe C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\OpenHide.ogg C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ResumeFormat.zip C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File created \??\c:\program files (x86)\3uems08bv-HELP-NEED.txt C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\CompleteSelect.svg C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\CompressImport.wax C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\FindDebug.tmp C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\GetImport.mpp C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ResolveResume.wma C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\SetUnpublish.ADTS C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\TestSave.mp2v C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\UninstallUndo.vssm C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\BackupSubmit.emz C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\ConfirmDismount.eps C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\GrantCompare.mpv2 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\GroupFormat.clr C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\OutShow.001 C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\RevokeOptimize.potm C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
File opened for modification \??\c:\program files\UnpublishStop.vsdm C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe

"C:\Users\Admin\AppData\Local\Temp\6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 8.8.8.8:53 rieed.de udp
US 8.8.8.8:53 wmiadmin.com udp
US 172.67.173.152:443 wmiadmin.com tcp
US 8.8.8.8:53 cwsitservices.co.uk udp
GB 35.214.77.27:443 cwsitservices.co.uk tcp
US 8.8.8.8:53 tanzprojekt.com udp
FR 5.175.14.11:443 tanzprojekt.com tcp
US 8.8.8.8:53 aselbermachen.com udp
CA 172.105.27.61:443 aselbermachen.com tcp
US 8.8.8.8:53 drnice.de udp
DE 78.47.54.3:443 drnice.de tcp
US 8.8.8.8:53 adoptioperheet.fi udp
FI 95.217.160.242:443 adoptioperheet.fi tcp
US 8.8.8.8:53 henricekupper.com udp
GB 78.129.239.42:443 henricekupper.com tcp
US 8.8.8.8:53 christinarebuffetcourses.com udp
DE 35.242.240.46:443 christinarebuffetcourses.com tcp
US 8.8.8.8:53 nvwoodwerks.com udp
US 188.114.97.0:443 nvwoodwerks.com tcp
US 8.8.8.8:53 nvwoodworks.com udp
US 188.114.96.0:443 nvwoodworks.com tcp
US 8.8.8.8:53 resinwerksstudio.com udp
CA 23.227.38.65:443 resinwerksstudio.com tcp
US 8.8.8.8:53 facettenreich27.de udp
ES 185.107.227.241:443 facettenreich27.de tcp
US 8.8.8.8:53 craigvalentineacademy.com udp
US 35.208.53.255:443 craigvalentineacademy.com tcp
US 8.8.8.8:53 turkcaparbariatrics.com udp
TR 178.157.8.3:443 turkcaparbariatrics.com tcp
US 8.8.8.8:53 fizzl.ru udp
LV 91.194.76.170:443 fizzl.ru tcp
US 8.8.8.8:53 ontrailsandboulevards.com udp
BG 194.1.147.60:443 ontrailsandboulevards.com tcp
US 8.8.8.8:53 ora-it.de udp
FR 176.28.10.103:443 ora-it.de tcp
US 8.8.8.8:53 www.ora-it.de udp
FR 176.28.10.103:443 www.ora-it.de tcp
US 8.8.8.8:53 monark.com udp
US 76.223.27.102:443 monark.com tcp
US 8.8.8.8:53 visiativ-industry.fr udp
FR 51.68.244.60:443 visiativ-industry.fr tcp
US 8.8.8.8:53 www.visiativ-solutions.fr udp
FR 51.68.244.60:443 www.visiativ-solutions.fr tcp
FR 51.68.244.60:443 www.visiativ-solutions.fr tcp
US 8.8.8.8:53 gasbarre.com udp
US 172.67.73.130:443 gasbarre.com tcp
US 8.8.8.8:53 www.gasbarre.com udp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 172.67.73.130:443 www.gasbarre.com tcp
US 8.8.8.8:53 vibethink.net udp
US 188.114.97.0:443 vibethink.net tcp
US 8.8.8.8:53 gaiam.nl udp
DE 78.46.9.130:443 gaiam.nl tcp
US 172.67.73.175:443 www.flowfitness.com tcp
US 8.8.8.8:53 kevinjodea.com udp
HK 47.75.130.171:443 kevinjodea.com tcp

Files

memory/2584-130-0x0000000002FD7000-0x0000000002FF7000-memory.dmp

memory/2584-131-0x0000000002FD7000-0x0000000002FF7000-memory.dmp

memory/2584-132-0x0000000002EE0000-0x0000000002F0B000-memory.dmp

memory/2584-133-0x0000000000400000-0x000000000042D000-memory.dmp

memory/456-134-0x0000025826F60000-0x0000025826F70000-memory.dmp

memory/456-135-0x0000025827620000-0x0000025827630000-memory.dmp

memory/456-136-0x0000025829CE0000-0x0000025829CE4000-memory.dmp

memory/1328-137-0x00000202DA8C0000-0x00000202DA8E2000-memory.dmp

memory/1328-138-0x00007FFCFEEC3000-0x00007FFCFEEC5000-memory.dmp

memory/1328-140-0x00000202DA903000-0x00000202DA905000-memory.dmp

memory/1328-141-0x00000202DA906000-0x00000202DA908000-memory.dmp

memory/1328-139-0x00000202DA900000-0x00000202DA902000-memory.dmp