Analysis Overview
SHA256
2da5fccb18e96468e1c327ae2d2dc072106dfd5f4e1f70ae71d10541221d5c22
Threat Level: Known bad
The file 6e350d1e48ed8f2515c30714db2343a2 was found to be: Known bad.
Malicious Activity Summary
ModiLoader Second Stage
Modiloader family
ModiLoader, DBatLoader
MetaSploit
ModiLoader Second Stage
Drops file in Drivers directory
Deletes itself
Executes dropped EXE
Drops file in System32 directory
Drops file in Windows directory
Program crash
Unsigned PE
Suspicious behavior: LoadsDriver
Modifies data under HKEY_USERS
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-01-22 00:13
Signatures
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Modiloader family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-22 00:13
Reported
2024-01-22 00:15
Platform
win7-20231215-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
MetaSploit
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\drivers\sysdrv32.sys | C:\Windows\security\svchost.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\security\svchost.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\security\svchost.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat | C:\Windows\security\svchost.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\security\svchost.exe | C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe | N/A |
| File opened for modification | C:\Windows\security\svchost.exe | C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" | C:\Windows\security\svchost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\security\svchost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Windows\security\svchost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Windows\security\svchost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\security\svchost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Windows\security\svchost.exe | N/A |
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe
"C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 10.0.0.1:445 | tcp | |
| N/A | 10.0.0.2:445 | tcp | |
| N/A | 10.0.0.3:445 | tcp | |
| N/A | 10.0.0.4:445 | tcp | |
| US | 8.8.8.8:53 | nt.arrancar.org | udp |
| N/A | 10.0.0.5:445 | tcp | |
| N/A | 10.0.0.6:445 | tcp | |
| N/A | 10.0.0.7:445 | tcp | |
| N/A | 10.0.0.8:445 | tcp | |
| N/A | 10.0.0.9:445 | tcp | |
| N/A | 10.0.0.10:445 | tcp | |
| N/A | 10.0.0.11:445 | tcp | |
| N/A | 10.0.0.12:445 | tcp | |
| N/A | 10.0.0.13:445 | tcp | |
| N/A | 10.0.0.14:445 | tcp | |
| N/A | 10.0.0.15:445 | tcp | |
| N/A | 10.0.0.16:445 | tcp | |
| N/A | 10.0.0.17:445 | tcp | |
| N/A | 10.0.0.18:445 | tcp | |
| N/A | 10.0.0.19:445 | tcp | |
| N/A | 10.0.0.20:445 | tcp | |
| N/A | 10.0.0.21:445 | tcp | |
| N/A | 10.0.0.22:445 | tcp | |
| N/A | 10.0.0.23:445 | tcp | |
| N/A | 10.0.0.24:445 | tcp | |
| N/A | 10.0.0.25:445 | tcp | |
| N/A | 10.0.0.26:445 | tcp | |
| N/A | 10.0.0.27:445 | tcp | |
| N/A | 10.0.0.28:445 | tcp | |
| N/A | 10.0.0.29:445 | tcp | |
| N/A | 10.0.0.30:445 | tcp | |
| N/A | 10.0.0.31:445 | tcp | |
| N/A | 10.0.0.32:445 | tcp | |
| N/A | 10.0.0.33:445 | tcp | |
| N/A | 10.0.0.34:445 | tcp | |
| N/A | 10.0.0.35:445 | tcp | |
| N/A | 10.0.0.36:445 | tcp | |
| N/A | 10.0.0.37:445 | tcp | |
| N/A | 10.0.0.38:445 | tcp | |
| N/A | 10.0.0.39:445 | tcp | |
| N/A | 10.0.0.40:445 | tcp | |
| N/A | 10.0.0.41:445 | tcp | |
| N/A | 10.0.0.42:445 | tcp | |
| N/A | 10.0.0.43:445 | tcp | |
| N/A | 10.0.0.44:445 | tcp | |
| N/A | 10.0.0.45:445 | tcp | |
| N/A | 10.0.0.46:445 | tcp | |
| N/A | 10.0.0.47:445 | tcp | |
| N/A | 10.0.0.48:445 | tcp | |
| N/A | 10.0.0.49:445 | tcp | |
| N/A | 10.0.0.50:445 | tcp | |
| N/A | 10.0.0.51:445 | tcp | |
| N/A | 10.0.0.52:445 | tcp | |
| N/A | 10.0.0.53:445 | tcp | |
| N/A | 10.0.0.54:445 | tcp | |
| N/A | 10.0.0.55:445 | tcp | |
| N/A | 10.0.0.56:445 | tcp | |
| N/A | 10.0.0.57:445 | tcp | |
| N/A | 10.0.0.58:445 | tcp | |
| N/A | 10.0.0.59:445 | tcp | |
| N/A | 10.0.0.60:445 | tcp | |
| N/A | 10.0.0.61:445 | tcp | |
| N/A | 10.0.0.62:445 | tcp | |
| N/A | 10.0.0.63:445 | tcp | |
| N/A | 10.0.0.64:445 | tcp | |
| N/A | 10.0.0.65:445 | tcp | |
| N/A | 10.0.0.66:445 | tcp | |
| N/A | 10.0.0.67:445 | tcp | |
| N/A | 10.0.0.68:445 | tcp | |
| N/A | 10.0.0.69:445 | tcp | |
| N/A | 10.0.0.70:445 | tcp | |
| N/A | 10.0.0.71:445 | tcp | |
| N/A | 10.0.0.72:445 | tcp | |
| N/A | 10.0.0.73:445 | tcp | |
| N/A | 10.0.0.74:445 | tcp | |
| N/A | 10.0.0.75:445 | tcp | |
| N/A | 10.0.0.76:445 | tcp | |
| N/A | 10.0.0.77:445 | tcp | |
| N/A | 10.0.0.78:445 | tcp | |
| N/A | 10.0.0.79:445 | tcp | |
| N/A | 10.0.0.80:445 | tcp | |
| N/A | 10.0.0.81:445 | tcp | |
| N/A | 10.0.0.82:445 | tcp | |
| N/A | 10.0.0.83:445 | tcp | |
| N/A | 10.0.0.84:445 | tcp | |
| N/A | 10.0.0.85:445 | tcp | |
| N/A | 10.0.0.86:445 | tcp | |
| N/A | 10.0.0.87:445 | tcp | |
| N/A | 10.0.0.88:445 | tcp | |
| N/A | 10.0.0.89:445 | tcp | |
| N/A | 10.0.0.90:445 | tcp | |
| N/A | 10.0.0.91:445 | tcp | |
| N/A | 10.0.0.92:445 | tcp | |
| N/A | 10.0.0.93:445 | tcp | |
| N/A | 10.0.0.94:445 | tcp | |
| N/A | 10.0.0.95:445 | tcp | |
| N/A | 10.0.0.96:445 | tcp | |
| N/A | 10.0.0.97:445 | tcp | |
| N/A | 10.0.0.98:445 | tcp | |
| N/A | 10.0.0.99:445 | tcp | |
| N/A | 10.0.0.100:445 | tcp | |
| N/A | 10.0.0.101:445 | tcp | |
| N/A | 10.0.0.102:445 | tcp | |
| N/A | 10.0.0.103:445 | tcp | |
| N/A | 10.0.0.104:445 | tcp | |
| N/A | 10.0.0.105:445 | tcp | |
| N/A | 10.0.0.106:445 | tcp | |
| N/A | 10.0.0.107:445 | tcp | |
| N/A | 10.0.0.108:445 | tcp | |
| N/A | 10.0.0.109:445 | tcp | |
| N/A | 10.0.0.110:445 | tcp | |
| N/A | 10.0.0.111:445 | tcp | |
| N/A | 10.0.0.112:445 | tcp | |
| N/A | 10.0.0.113:445 | tcp | |
| N/A | 10.0.0.114:445 | tcp | |
| N/A | 10.0.0.115:445 | tcp | |
| N/A | 10.0.0.116:445 | tcp | |
| N/A | 10.0.0.117:445 | tcp | |
| N/A | 10.0.0.118:445 | tcp | |
| N/A | 10.0.0.119:445 | tcp | |
| N/A | 10.0.0.120:445 | tcp | |
| N/A | 10.0.0.121:445 | tcp | |
| N/A | 10.0.0.122:445 | tcp | |
| N/A | 10.0.0.123:445 | tcp | |
| N/A | 10.0.0.124:445 | tcp | |
| N/A | 10.0.0.125:445 | tcp | |
| N/A | 10.0.0.126:445 | tcp | |
| N/A | 10.0.0.127:445 | tcp | |
| N/A | 10.0.0.128:445 | tcp | |
| N/A | 10.0.0.129:445 | tcp | |
| N/A | 10.0.0.130:445 | tcp | |
| N/A | 10.0.0.131:445 | tcp | |
| N/A | 10.0.0.132:445 | tcp | |
| N/A | 10.0.0.133:445 | tcp | |
| N/A | 10.0.0.134:445 | tcp | |
| N/A | 10.0.0.135:445 | tcp | |
| N/A | 10.0.0.136:445 | tcp | |
| N/A | 10.0.0.137:445 | tcp | |
| N/A | 10.0.0.138:445 | tcp | |
| N/A | 10.0.0.139:445 | tcp | |
| N/A | 10.0.0.140:445 | tcp | |
| N/A | 10.0.0.141:445 | tcp | |
| N/A | 10.0.0.142:445 | tcp | |
| N/A | 10.0.0.143:445 | tcp | |
| N/A | 10.0.0.144:445 | tcp | |
| N/A | 10.0.0.145:445 | tcp | |
| N/A | 10.0.0.146:445 | tcp | |
| N/A | 10.0.0.147:445 | tcp | |
| N/A | 10.0.0.148:445 | tcp | |
| N/A | 10.0.0.149:445 | tcp | |
| N/A | 10.0.0.150:445 | tcp | |
| N/A | 10.0.0.151:445 | tcp | |
| N/A | 10.0.0.152:445 | tcp | |
| N/A | 10.0.0.153:445 | tcp | |
| N/A | 10.0.0.154:445 | tcp | |
| N/A | 10.0.0.155:445 | tcp | |
| N/A | 10.0.0.156:445 | tcp | |
| N/A | 10.0.0.157:445 | tcp | |
| N/A | 10.0.0.158:445 | tcp | |
| N/A | 10.0.0.159:445 | tcp | |
| N/A | 10.0.0.160:445 | tcp | |
| N/A | 10.0.0.161:445 | tcp | |
| N/A | 10.0.0.162:445 | tcp | |
| N/A | 10.0.0.163:445 | tcp | |
| N/A | 10.0.0.164:445 | tcp | |
| N/A | 10.0.0.165:445 | tcp | |
| N/A | 10.0.0.166:445 | tcp | |
| N/A | 10.0.0.167:445 | tcp | |
| N/A | 10.0.0.168:445 | tcp | |
| N/A | 10.0.0.169:445 | tcp | |
| N/A | 10.0.0.170:445 | tcp | |
| N/A | 10.0.0.171:445 | tcp | |
| N/A | 10.0.0.172:445 | tcp | |
| N/A | 10.0.0.173:445 | tcp | |
| N/A | 10.0.0.174:445 | tcp | |
| N/A | 10.0.0.175:445 | tcp | |
| N/A | 10.0.0.176:445 | tcp | |
| N/A | 10.0.0.177:445 | tcp | |
| N/A | 10.0.0.178:445 | tcp | |
| N/A | 10.0.0.179:445 | tcp | |
| N/A | 10.0.0.180:445 | tcp | |
| N/A | 10.0.0.181:445 | tcp | |
| N/A | 10.0.0.182:445 | tcp | |
| N/A | 10.0.0.183:445 | tcp | |
| N/A | 10.0.0.184:445 | tcp | |
| N/A | 10.0.0.185:445 | tcp | |
| N/A | 10.0.0.186:445 | tcp | |
| N/A | 10.0.0.187:445 | tcp | |
| N/A | 10.0.0.188:445 | tcp | |
| N/A | 10.0.0.189:445 | tcp | |
| N/A | 10.0.0.190:445 | tcp | |
| N/A | 10.0.0.191:445 | tcp | |
| N/A | 10.0.0.192:445 | tcp | |
| N/A | 10.0.0.193:445 | tcp | |
| N/A | 10.0.0.194:445 | tcp | |
| N/A | 10.0.0.195:445 | tcp | |
| N/A | 10.0.0.196:445 | tcp | |
| N/A | 10.0.0.197:445 | tcp | |
| N/A | 10.0.0.198:445 | tcp | |
| N/A | 10.0.0.199:445 | tcp | |
| N/A | 10.0.0.200:445 | tcp | |
| N/A | 10.0.0.201:445 | tcp | |
| N/A | 10.0.0.202:445 | tcp | |
| N/A | 10.0.0.203:445 | tcp | |
| N/A | 10.0.0.204:445 | tcp | |
| N/A | 10.0.0.205:445 | tcp | |
| N/A | 10.0.0.206:445 | tcp | |
| N/A | 10.0.0.207:445 | tcp | |
| N/A | 10.0.0.208:445 | tcp | |
| N/A | 10.0.0.209:445 | tcp | |
| N/A | 10.0.0.210:445 | tcp | |
| N/A | 10.0.0.211:445 | tcp | |
| N/A | 10.0.0.212:445 | tcp | |
| N/A | 10.0.0.213:445 | tcp | |
| N/A | 10.0.0.214:445 | tcp | |
| N/A | 10.0.0.215:445 | tcp | |
| N/A | 10.0.0.216:445 | tcp | |
| N/A | 10.0.0.217:445 | tcp | |
| N/A | 10.0.0.218:445 | tcp | |
| N/A | 10.0.0.219:445 | tcp | |
| N/A | 10.0.0.220:445 | tcp | |
| N/A | 10.0.0.221:445 | tcp | |
| N/A | 10.0.0.222:445 | tcp | |
| N/A | 10.0.0.223:445 | tcp | |
| N/A | 10.0.0.224:445 | tcp | |
| N/A | 10.0.0.225:445 | tcp | |
| N/A | 10.0.0.226:445 | tcp | |
| N/A | 10.0.0.227:445 | tcp | |
| N/A | 10.0.0.228:445 | tcp | |
| N/A | 10.0.0.229:445 | tcp | |
| N/A | 10.0.0.230:445 | tcp | |
| N/A | 10.0.0.231:445 | tcp | |
| N/A | 10.0.0.232:445 | tcp | |
| N/A | 10.0.0.233:445 | tcp | |
| N/A | 10.0.0.234:445 | tcp | |
| N/A | 10.0.0.235:445 | tcp | |
| N/A | 10.0.0.236:445 | tcp | |
| N/A | 10.0.0.237:445 | tcp | |
| N/A | 10.0.0.238:445 | tcp | |
| N/A | 10.0.0.239:445 | tcp | |
| N/A | 10.0.0.240:445 | tcp | |
| N/A | 10.0.0.241:445 | tcp | |
| N/A | 10.0.0.242:445 | tcp | |
| N/A | 10.0.0.243:445 | tcp | |
| N/A | 10.0.0.244:445 | tcp | |
| N/A | 10.0.0.245:445 | tcp | |
| N/A | 10.0.0.246:445 | tcp | |
| N/A | 10.0.0.247:445 | tcp | |
| N/A | 10.0.0.248:445 | tcp | |
| N/A | 10.0.0.249:445 | tcp | |
| N/A | 10.0.0.250:445 | tcp | |
| N/A | 10.0.0.251:445 | tcp | |
| N/A | 10.0.0.252:445 | tcp | |
| N/A | 10.0.0.253:445 | tcp | |
| N/A | 10.0.0.254:445 | tcp | |
| N/A | 10.0.0.255:445 | tcp | |
| N/A | 10.0.1.0:445 | tcp | |
| N/A | 10.0.1.1:445 | tcp | |
| N/A | 10.0.1.2:445 | tcp | |
| N/A | 10.0.1.3:445 | tcp | |
| N/A | 10.0.1.4:445 | tcp | |
| N/A | 10.0.1.5:445 | tcp | |
| N/A | 10.0.1.6:445 | tcp | |
| N/A | 10.0.1.7:445 | tcp | |
| N/A | 10.0.1.8:445 | tcp | |
| N/A | 10.0.1.9:445 | tcp | |
| N/A | 10.0.1.10:445 | tcp | |
| N/A | 10.0.1.11:445 | tcp | |
| N/A | 10.0.1.12:445 | tcp | |
| N/A | 10.0.1.13:445 | tcp | |
| N/A | 10.0.1.14:445 | tcp | |
| N/A | 10.0.1.15:445 | tcp | |
| N/A | 10.0.1.16:445 | tcp | |
| N/A | 10.0.1.17:445 | tcp | |
| N/A | 10.0.1.18:445 | tcp | |
| N/A | 10.0.1.19:445 | tcp | |
| N/A | 10.0.1.20:445 | tcp | |
| N/A | 10.0.1.21:445 | tcp | |
| N/A | 10.0.1.22:445 | tcp | |
| N/A | 10.0.1.23:445 | tcp | |
| N/A | 10.0.1.24:445 | tcp | |
| N/A | 10.0.1.25:445 | tcp | |
| N/A | 10.0.1.26:445 | tcp | |
| N/A | 10.0.1.27:445 | tcp | |
| N/A | 10.0.1.28:445 | tcp | |
| N/A | 10.0.1.29:445 | tcp | |
| N/A | 10.0.1.30:445 | tcp | |
| N/A | 10.0.1.31:445 | tcp | |
| N/A | 10.0.1.32:445 | tcp | |
| N/A | 10.0.1.33:445 | tcp | |
| N/A | 10.0.1.34:445 | tcp | |
| N/A | 10.0.1.35:445 | tcp | |
| N/A | 10.0.1.36:445 | tcp | |
| N/A | 10.0.1.37:445 | tcp | |
| N/A | 10.0.1.38:445 | tcp | |
| N/A | 10.0.1.39:445 | tcp | |
| N/A | 10.0.1.40:445 | tcp | |
| N/A | 10.0.1.41:445 | tcp | |
| N/A | 10.0.1.42:445 | tcp | |
| N/A | 10.0.1.43:445 | tcp | |
| N/A | 10.0.1.44:445 | tcp | |
| N/A | 10.0.1.45:445 | tcp | |
| N/A | 10.0.1.46:445 | tcp | |
| N/A | 10.0.1.47:445 | tcp | |
| N/A | 10.0.1.48:445 | tcp | |
| N/A | 10.0.1.49:445 | tcp | |
| N/A | 10.0.1.50:445 | tcp | |
| N/A | 10.0.1.51:445 | tcp | |
| N/A | 10.0.1.52:445 | tcp | |
| N/A | 10.0.1.53:445 | tcp | |
| N/A | 10.0.1.54:445 | tcp | |
| N/A | 10.0.1.55:445 | tcp | |
| N/A | 10.0.1.56:445 | tcp | |
| N/A | 10.0.1.57:445 | tcp | |
| N/A | 10.0.1.58:445 | tcp | |
| N/A | 10.0.1.59:445 | tcp | |
| N/A | 10.0.1.60:445 | tcp | |
| N/A | 10.0.1.61:445 | tcp | |
| N/A | 10.0.1.62:445 | tcp | |
| N/A | 10.0.1.63:445 | tcp | |
| N/A | 10.0.1.64:445 | tcp | |
| N/A | 10.0.1.65:445 | tcp | |
| N/A | 10.0.1.66:445 | tcp | |
| N/A | 10.0.1.67:445 | tcp | |
| N/A | 10.0.1.68:445 | tcp | |
| N/A | 10.0.1.69:445 | tcp | |
| N/A | 10.0.1.70:445 | tcp | |
| N/A | 10.0.1.71:445 | tcp | |
| N/A | 10.0.1.72:445 | tcp | |
| N/A | 10.0.1.73:445 | tcp | |
| N/A | 10.0.1.74:445 | tcp | |
| N/A | 10.0.1.75:445 | tcp | |
| N/A | 10.0.1.76:445 | tcp | |
| N/A | 10.0.1.77:445 | tcp | |
| N/A | 10.0.1.78:445 | tcp | |
| N/A | 10.0.1.79:445 | tcp | |
| N/A | 10.0.1.80:445 | tcp | |
| N/A | 10.0.1.81:445 | tcp | |
| N/A | 10.0.1.82:445 | tcp | |
| N/A | 10.0.1.83:445 | tcp | |
| N/A | 10.0.1.84:445 | tcp | |
| N/A | 10.0.1.85:445 | tcp | |
| N/A | 10.0.1.86:445 | tcp | |
| N/A | 10.0.1.87:445 | tcp | |
| N/A | 10.0.1.88:445 | tcp | |
| N/A | 10.0.1.89:445 | tcp | |
| N/A | 10.0.1.90:445 | tcp | |
| N/A | 10.0.1.91:445 | tcp | |
| N/A | 10.0.1.92:445 | tcp | |
| N/A | 10.0.1.93:445 | tcp | |
| N/A | 10.0.1.94:445 | tcp | |
| N/A | 10.0.1.95:445 | tcp | |
| N/A | 10.0.1.96:445 | tcp | |
| N/A | 10.0.1.97:445 | tcp | |
| N/A | 10.0.1.98:445 | tcp | |
| N/A | 10.0.1.99:445 | tcp | |
| N/A | 10.0.1.100:445 | tcp | |
| N/A | 10.0.1.101:445 | tcp | |
| N/A | 10.0.1.102:445 | tcp | |
| N/A | 10.0.1.103:445 | tcp | |
| N/A | 10.0.1.104:445 | tcp | |
| N/A | 10.0.1.105:445 | tcp | |
| N/A | 10.0.1.106:445 | tcp | |
| N/A | 10.0.1.107:445 | tcp | |
| N/A | 10.0.1.108:445 | tcp | |
| N/A | 10.0.1.109:445 | tcp | |
| N/A | 10.0.1.110:445 | tcp | |
| N/A | 10.0.1.111:445 | tcp | |
| N/A | 10.0.1.112:445 | tcp | |
| N/A | 10.0.1.113:445 | tcp | |
| N/A | 10.0.1.114:445 | tcp | |
| N/A | 10.0.1.115:445 | tcp | |
| N/A | 10.0.1.116:445 | tcp | |
| N/A | 10.0.1.117:445 | tcp | |
| N/A | 10.0.1.118:445 | tcp | |
| N/A | 10.0.1.119:445 | tcp | |
| N/A | 10.0.1.120:445 | tcp | |
| N/A | 10.0.1.121:445 | tcp | |
| N/A | 10.0.1.122:445 | tcp | |
| N/A | 10.0.1.123:445 | tcp | |
| N/A | 10.0.1.124:445 | tcp | |
| N/A | 10.0.1.125:445 | tcp | |
| N/A | 10.0.1.126:445 | tcp | |
| N/A | 10.0.1.127:445 | tcp | |
| N/A | 10.0.1.128:445 | tcp | |
| N/A | 10.0.1.129:445 | tcp | |
| N/A | 10.0.1.130:445 | tcp | |
| N/A | 10.0.1.131:445 | tcp | |
| N/A | 10.0.1.132:445 | tcp | |
| N/A | 10.0.1.133:445 | tcp | |
| N/A | 10.0.1.134:445 | tcp | |
| N/A | 10.0.1.135:445 | tcp | |
| N/A | 10.0.1.136:445 | tcp | |
| N/A | 10.0.1.137:445 | tcp | |
| N/A | 10.0.1.138:445 | tcp | |
| N/A | 10.0.1.139:445 | tcp | |
| N/A | 10.0.1.140:445 | tcp | |
| N/A | 10.0.1.141:445 | tcp | |
| N/A | 10.0.1.142:445 | tcp | |
| N/A | 10.0.1.143:445 | tcp | |
| N/A | 10.0.1.144:445 | tcp | |
| N/A | 10.0.1.145:445 | tcp | |
| N/A | 10.0.1.146:445 | tcp | |
| N/A | 10.0.1.147:445 | tcp | |
| N/A | 10.0.1.148:445 | tcp | |
| N/A | 10.0.1.149:445 | tcp | |
| N/A | 10.0.1.150:445 | tcp | |
| N/A | 10.0.1.151:445 | tcp | |
| N/A | 10.0.1.152:445 | tcp | |
| N/A | 10.0.1.153:445 | tcp | |
| N/A | 10.0.1.154:445 | tcp | |
| N/A | 10.0.1.155:445 | tcp | |
| N/A | 10.0.1.156:445 | tcp | |
| N/A | 10.0.1.157:445 | tcp | |
| N/A | 10.0.1.158:445 | tcp | |
| N/A | 10.0.1.159:445 | tcp | |
| N/A | 10.0.1.160:445 | tcp | |
| N/A | 10.0.1.161:445 | tcp | |
| N/A | 10.0.1.162:445 | tcp | |
| N/A | 10.0.1.163:445 | tcp | |
| N/A | 10.0.1.164:445 | tcp | |
| N/A | 10.0.1.165:445 | tcp | |
| N/A | 10.0.1.166:445 | tcp | |
| N/A | 10.0.1.167:445 | tcp | |
| N/A | 10.0.1.168:445 | tcp | |
| N/A | 10.0.1.169:445 | tcp | |
| N/A | 10.0.1.170:445 | tcp | |
| N/A | 10.0.1.171:445 | tcp | |
| N/A | 10.0.1.172:445 | tcp | |
| N/A | 10.0.1.173:445 | tcp | |
| N/A | 10.0.1.174:445 | tcp | |
| N/A | 10.0.1.175:445 | tcp | |
| N/A | 10.0.1.176:445 | tcp | |
| N/A | 10.0.1.177:445 | tcp | |
| N/A | 10.0.1.178:445 | tcp | |
| N/A | 10.0.1.179:445 | tcp | |
| N/A | 10.0.1.180:445 | tcp | |
| N/A | 10.0.1.181:445 | tcp | |
| N/A | 10.0.1.182:445 | tcp | |
| N/A | 10.0.1.183:445 | tcp | |
| N/A | 10.0.1.184:445 | tcp | |
| N/A | 10.0.1.185:445 | tcp | |
| N/A | 10.0.1.186:445 | tcp | |
| N/A | 10.0.1.187:445 | tcp | |
| N/A | 10.0.1.188:445 | tcp | |
| N/A | 10.0.1.189:445 | tcp | |
| N/A | 10.0.1.190:445 | tcp | |
| N/A | 10.0.1.191:445 | tcp | |
| N/A | 10.0.1.192:445 | tcp | |
| N/A | 10.0.1.193:445 | tcp | |
| N/A | 10.0.1.194:445 | tcp | |
| N/A | 10.0.1.195:445 | tcp | |
| N/A | 10.0.1.196:445 | tcp | |
| N/A | 10.0.1.197:445 | tcp | |
| N/A | 10.0.1.198:445 | tcp | |
| N/A | 10.0.1.199:445 | tcp | |
| N/A | 10.0.1.200:445 | tcp | |
| N/A | 10.0.1.201:445 | tcp | |
| N/A | 10.0.1.202:445 | tcp | |
| N/A | 10.0.1.203:445 | tcp | |
| N/A | 10.0.1.204:445 | tcp | |
| N/A | 10.0.1.205:445 | tcp | |
| N/A | 10.0.1.206:445 | tcp | |
| N/A | 10.0.1.207:445 | tcp | |
| N/A | 10.0.1.208:445 | tcp | |
| N/A | 10.0.1.209:445 | tcp | |
| N/A | 10.0.1.210:445 | tcp | |
| N/A | 10.0.1.211:445 | tcp | |
| N/A | 10.0.1.212:445 | tcp | |
| N/A | 10.0.1.213:445 | tcp | |
| N/A | 10.0.1.214:445 | tcp | |
| N/A | 10.0.1.215:445 | tcp | |
| N/A | 10.0.1.216:445 | tcp | |
| N/A | 10.0.1.217:445 | tcp | |
| N/A | 10.0.1.218:445 | tcp | |
| N/A | 10.0.1.219:445 | tcp | |
| N/A | 10.0.1.220:445 | tcp | |
| N/A | 10.0.1.221:445 | tcp | |
| N/A | 10.0.1.222:445 | tcp | |
| N/A | 10.0.1.223:445 | tcp | |
| N/A | 10.0.1.224:445 | tcp | |
| N/A | 10.0.1.225:445 | tcp | |
| N/A | 10.0.1.226:445 | tcp | |
| N/A | 10.0.1.227:445 | tcp | |
| N/A | 10.0.1.228:445 | tcp | |
| N/A | 10.0.1.229:445 | tcp | |
| N/A | 10.0.1.230:445 | tcp | |
| N/A | 10.0.1.231:445 | tcp | |
| N/A | 10.0.1.232:445 | tcp | |
| N/A | 10.0.1.233:445 | tcp | |
| N/A | 10.0.1.234:445 | tcp | |
| N/A | 10.0.1.235:445 | tcp | |
| N/A | 10.0.1.236:445 | tcp | |
| N/A | 10.0.1.237:445 | tcp | |
| N/A | 10.0.1.238:445 | tcp | |
| N/A | 10.0.1.239:445 | tcp | |
| N/A | 10.0.1.240:445 | tcp | |
| N/A | 10.0.1.241:445 | tcp | |
| N/A | 10.0.1.242:445 | tcp | |
| N/A | 10.0.1.243:445 | tcp | |
| N/A | 10.0.1.244:445 | tcp | |
| N/A | 10.0.1.245:445 | tcp | |
| N/A | 10.0.1.246:445 | tcp | |
| N/A | 10.0.1.247:445 | tcp | |
| N/A | 10.0.1.248:445 | tcp | |
| N/A | 10.0.1.249:445 | tcp | |
| N/A | 10.0.1.250:445 | tcp | |
| N/A | 10.0.1.251:445 | tcp | |
| N/A | 10.0.1.252:445 | tcp | |
| N/A | 10.0.1.253:445 | tcp | |
| N/A | 10.0.1.254:445 | tcp | |
| N/A | 10.0.1.255:445 | tcp | |
| N/A | 10.0.2.0:445 | tcp | |
| N/A | 10.0.2.1:445 | tcp | |
| N/A | 10.0.2.2:445 | tcp | |
| N/A | 10.0.2.3:445 | tcp | |
| N/A | 10.0.2.4:445 | tcp | |
| N/A | 10.0.2.5:445 | tcp | |
| N/A | 10.0.2.6:445 | tcp | |
| N/A | 10.0.2.7:445 | tcp | |
| N/A | 10.0.2.8:445 | tcp | |
| N/A | 10.0.2.9:445 | tcp | |
| N/A | 10.0.2.10:445 | tcp | |
| N/A | 10.0.2.11:445 | tcp | |
| N/A | 10.0.2.12:445 | tcp | |
| N/A | 10.0.2.13:445 | tcp | |
| N/A | 10.0.2.14:445 | tcp | |
| N/A | 10.0.2.15:445 | tcp | |
| N/A | 10.0.2.16:445 | tcp | |
| N/A | 10.0.2.17:445 | tcp | |
| N/A | 10.0.2.18:445 | tcp | |
| N/A | 10.0.2.19:445 | tcp | |
| N/A | 10.0.2.20:445 | tcp | |
| N/A | 10.0.2.21:445 | tcp | |
| N/A | 10.0.2.22:445 | tcp | |
| N/A | 10.0.2.23:445 | tcp | |
| N/A | 10.0.2.24:445 | tcp | |
| N/A | 10.0.2.25:445 | tcp | |
| N/A | 10.0.2.26:445 | tcp | |
| N/A | 10.0.2.27:445 | tcp | |
| N/A | 10.0.2.28:445 | tcp | |
| N/A | 10.0.2.29:445 | tcp | |
| N/A | 10.0.2.30:445 | tcp | |
| N/A | 10.0.2.31:445 | tcp | |
| N/A | 10.0.2.32:445 | tcp | |
| N/A | 10.0.2.33:445 | tcp | |
| N/A | 10.0.2.34:445 | tcp | |
| N/A | 10.0.2.35:445 | tcp | |
| N/A | 10.0.2.36:445 | tcp | |
| N/A | 10.0.2.37:445 | tcp | |
| N/A | 10.0.2.38:445 | tcp | |
| N/A | 10.0.2.39:445 | tcp | |
| N/A | 10.0.2.40:445 | tcp | |
| N/A | 10.0.2.41:445 | tcp | |
| N/A | 10.0.2.42:445 | tcp | |
| N/A | 10.0.2.43:445 | tcp | |
| N/A | 10.0.2.44:445 | tcp | |
| N/A | 10.0.2.45:445 | tcp | |
| N/A | 10.0.2.46:445 | tcp | |
| N/A | 10.0.2.47:445 | tcp | |
| N/A | 10.0.2.48:445 | tcp | |
| N/A | 10.0.2.49:445 | tcp | |
| N/A | 10.0.2.50:445 | tcp | |
| N/A | 10.0.2.51:445 | tcp | |
| N/A | 10.0.2.52:445 | tcp | |
| N/A | 10.0.2.53:445 | tcp | |
| N/A | 10.0.2.54:445 | tcp | |
| N/A | 10.0.2.55:445 | tcp | |
| N/A | 10.0.2.56:445 | tcp | |
| N/A | 10.0.2.57:445 | tcp | |
| N/A | 10.0.2.58:445 | tcp | |
| N/A | 10.0.2.59:445 | tcp | |
| N/A | 10.0.2.60:445 | tcp | |
| N/A | 10.0.2.61:445 | tcp | |
| N/A | 10.0.2.62:445 | tcp | |
| N/A | 10.0.2.63:445 | tcp | |
| N/A | 10.0.2.64:445 | tcp | |
| N/A | 10.0.2.65:445 | tcp | |
| N/A | 10.0.2.66:445 | tcp | |
| N/A | 10.0.2.67:445 | tcp | |
| N/A | 10.0.2.68:445 | tcp | |
| N/A | 10.0.2.69:445 | tcp | |
| N/A | 10.0.2.70:445 | tcp | |
| N/A | 10.0.2.71:445 | tcp | |
| N/A | 10.0.2.72:445 | tcp | |
| N/A | 10.0.2.73:445 | tcp | |
| N/A | 10.0.2.74:445 | tcp | |
| N/A | 10.0.2.75:445 | tcp | |
| N/A | 10.0.2.76:445 | tcp | |
| N/A | 10.0.2.77:445 | tcp | |
| N/A | 10.0.2.78:445 | tcp | |
| N/A | 10.0.2.79:445 | tcp | |
| N/A | 10.0.2.80:445 | tcp | |
| N/A | 10.0.2.81:445 | tcp | |
| N/A | 10.0.2.82:445 | tcp | |
| N/A | 10.0.2.83:445 | tcp | |
| N/A | 10.0.2.84:445 | tcp | |
| N/A | 10.0.2.85:445 | tcp | |
| N/A | 10.0.2.86:445 | tcp | |
| N/A | 10.0.2.87:445 | tcp | |
| N/A | 10.0.2.88:445 | tcp | |
| N/A | 10.0.2.89:445 | tcp | |
| N/A | 10.0.2.90:445 | tcp | |
| N/A | 10.0.2.91:445 | tcp | |
| N/A | 10.0.2.92:445 | tcp | |
| N/A | 10.0.2.93:445 | tcp | |
| N/A | 10.0.2.94:445 | tcp | |
| N/A | 10.0.2.95:445 | tcp | |
| N/A | 10.0.2.96:445 | tcp | |
| N/A | 10.0.2.97:445 | tcp | |
| N/A | 10.0.2.98:445 | tcp | |
| N/A | 10.0.2.99:445 | tcp | |
| N/A | 10.0.2.100:445 | tcp | |
| N/A | 10.0.2.101:445 | tcp | |
| N/A | 10.0.2.102:445 | tcp | |
| N/A | 10.0.2.103:445 | tcp | |
| N/A | 10.0.2.104:445 | tcp | |
| N/A | 10.0.2.105:445 | tcp | |
| N/A | 10.0.2.106:445 | tcp | |
| N/A | 10.0.2.107:445 | tcp | |
| N/A | 10.0.2.108:445 | tcp | |
| N/A | 10.0.2.109:445 | tcp | |
| N/A | 10.0.2.110:445 | tcp | |
| N/A | 10.0.2.111:445 | tcp | |
| N/A | 10.0.2.112:445 | tcp | |
| N/A | 10.0.2.113:445 | tcp | |
| N/A | 10.0.2.114:445 | tcp | |
| N/A | 10.0.2.115:445 | tcp | |
| N/A | 10.0.2.116:445 | tcp | |
| N/A | 10.0.2.117:445 | tcp | |
| N/A | 10.0.2.118:445 | tcp | |
| N/A | 10.0.2.119:445 | tcp | |
| N/A | 10.0.2.120:445 | tcp | |
| N/A | 10.0.2.121:445 | tcp | |
| N/A | 10.0.2.122:445 | tcp | |
| N/A | 10.0.2.123:445 | tcp | |
| N/A | 10.0.2.124:445 | tcp | |
| N/A | 10.0.2.125:445 | tcp | |
| N/A | 10.0.2.126:445 | tcp | |
| N/A | 10.0.2.127:445 | tcp | |
| N/A | 10.0.2.128:445 | tcp | |
| N/A | 10.0.2.129:445 | tcp | |
| N/A | 10.0.2.130:445 | tcp | |
| N/A | 10.0.2.131:445 | tcp | |
| N/A | 10.0.2.132:445 | tcp | |
| N/A | 10.0.2.133:445 | tcp | |
| N/A | 10.0.2.134:445 | tcp | |
| N/A | 10.0.2.135:445 | tcp | |
| N/A | 10.0.2.136:445 | tcp | |
| N/A | 10.0.2.137:445 | tcp | |
| N/A | 10.0.2.138:445 | tcp | |
| N/A | 10.0.2.139:445 | tcp | |
| N/A | 10.0.2.140:445 | tcp | |
| N/A | 10.0.2.141:445 | tcp | |
| N/A | 10.0.2.142:445 | tcp | |
| N/A | 10.0.2.143:445 | tcp | |
| N/A | 10.0.2.144:445 | tcp | |
| N/A | 10.0.2.145:445 | tcp | |
| N/A | 10.0.2.146:445 | tcp | |
| N/A | 10.0.2.147:445 | tcp | |
| N/A | 10.0.2.148:445 | tcp | |
| N/A | 10.0.2.149:445 | tcp | |
| N/A | 10.0.2.150:445 | tcp | |
| N/A | 10.0.2.151:445 | tcp | |
| N/A | 10.0.2.152:445 | tcp | |
| N/A | 10.0.2.153:445 | tcp | |
| N/A | 10.0.2.154:445 | tcp | |
| N/A | 10.0.2.155:445 | tcp | |
| N/A | 10.0.2.156:445 | tcp | |
| N/A | 10.0.2.157:445 | tcp | |
| N/A | 10.0.2.158:445 | tcp | |
| N/A | 10.0.2.159:445 | tcp | |
| N/A | 10.0.2.160:445 | tcp | |
| N/A | 10.0.2.161:445 | tcp | |
| N/A | 10.0.2.162:445 | tcp | |
| N/A | 10.0.2.163:445 | tcp | |
| N/A | 10.0.2.164:445 | tcp | |
| N/A | 10.0.2.165:445 | tcp | |
| N/A | 10.0.2.166:445 | tcp | |
| N/A | 10.0.2.167:445 | tcp | |
| N/A | 10.0.2.168:445 | tcp | |
| N/A | 10.0.2.169:445 | tcp | |
| N/A | 10.0.2.170:445 | tcp | |
| N/A | 10.0.2.171:445 | tcp | |
| N/A | 10.0.2.172:445 | tcp | |
| N/A | 10.0.2.173:445 | tcp | |
| N/A | 10.0.2.174:445 | tcp | |
| N/A | 10.0.2.175:445 | tcp | |
| N/A | 10.0.2.176:445 | tcp | |
| N/A | 10.0.2.177:445 | tcp | |
| N/A | 10.0.2.178:445 | tcp | |
| N/A | 10.0.2.179:445 | tcp | |
| N/A | 10.0.2.180:445 | tcp | |
| N/A | 10.0.2.181:445 | tcp | |
| N/A | 10.0.2.182:445 | tcp | |
| N/A | 10.0.2.183:445 | tcp | |
| N/A | 10.0.2.184:445 | tcp | |
| N/A | 10.0.2.185:445 | tcp | |
| N/A | 10.0.2.186:445 | tcp | |
| N/A | 10.0.2.187:445 | tcp | |
| N/A | 10.0.2.188:445 | tcp | |
| N/A | 10.0.2.189:445 | tcp | |
| N/A | 10.0.2.190:445 | tcp | |
| N/A | 10.0.2.191:445 | tcp | |
| N/A | 10.0.2.192:445 | tcp | |
| N/A | 10.0.2.193:445 | tcp | |
| N/A | 10.0.2.194:445 | tcp | |
| N/A | 10.0.2.195:445 | tcp | |
| N/A | 10.0.2.196:445 | tcp | |
| N/A | 10.0.2.197:445 | tcp | |
| N/A | 10.0.2.198:445 | tcp | |
| N/A | 10.0.2.199:445 | tcp | |
| N/A | 10.0.2.200:445 | tcp | |
| N/A | 10.0.2.201:445 | tcp | |
| N/A | 10.0.2.202:445 | tcp | |
| N/A | 10.0.2.203:445 | tcp | |
| N/A | 10.0.2.204:445 | tcp | |
| N/A | 10.0.2.205:445 | tcp | |
| N/A | 10.0.2.206:445 | tcp | |
| N/A | 10.0.2.207:445 | tcp | |
| N/A | 10.0.2.208:445 | tcp | |
| N/A | 10.0.2.209:445 | tcp | |
| N/A | 10.0.2.210:445 | tcp | |
| N/A | 10.0.2.211:445 | tcp | |
| N/A | 10.0.2.212:445 | tcp | |
| N/A | 10.0.2.213:445 | tcp | |
| N/A | 10.0.2.214:445 | tcp | |
| N/A | 10.0.2.215:445 | tcp | |
| N/A | 10.0.2.216:445 | tcp | |
| N/A | 10.0.2.217:445 | tcp | |
| N/A | 10.0.2.218:445 | tcp | |
| N/A | 10.0.2.219:445 | tcp | |
| N/A | 10.0.2.220:445 | tcp | |
| N/A | 10.0.2.221:445 | tcp | |
| N/A | 10.0.2.222:445 | tcp | |
| N/A | 10.0.2.223:445 | tcp | |
| N/A | 10.0.2.224:445 | tcp | |
| N/A | 10.0.2.225:445 | tcp | |
| N/A | 10.0.2.226:445 | tcp | |
| N/A | 10.0.2.227:445 | tcp | |
| N/A | 10.0.2.228:445 | tcp | |
| N/A | 10.0.2.229:445 | tcp | |
| N/A | 10.0.2.230:445 | tcp | |
| N/A | 10.0.2.231:445 | tcp | |
| N/A | 10.0.2.232:445 | tcp | |
| N/A | 10.0.2.233:445 | tcp | |
| N/A | 10.0.2.234:445 | tcp | |
| N/A | 10.0.2.235:445 | tcp | |
| N/A | 10.0.2.236:445 | tcp | |
| N/A | 10.0.2.237:445 | tcp | |
| N/A | 10.0.2.238:445 | tcp | |
| N/A | 10.0.2.239:445 | tcp | |
| N/A | 10.0.2.240:445 | tcp | |
| N/A | 10.0.2.241:445 | tcp | |
| N/A | 10.0.2.242:445 | tcp | |
| N/A | 10.0.2.243:445 | tcp | |
| N/A | 10.0.2.244:445 | tcp | |
| N/A | 10.0.2.245:445 | tcp | |
| N/A | 10.0.2.246:445 | tcp | |
| N/A | 10.0.2.247:445 | tcp | |
| N/A | 10.0.2.248:445 | tcp | |
| N/A | 10.0.2.249:445 | tcp | |
| N/A | 10.0.2.250:445 | tcp | |
| N/A | 10.0.2.251:445 | tcp | |
| N/A | 10.0.2.252:445 | tcp | |
| N/A | 10.0.2.253:445 | tcp | |
| N/A | 10.0.2.254:445 | tcp | |
| N/A | 10.0.2.255:445 | tcp | |
| N/A | 10.0.3.0:445 | tcp | |
| N/A | 10.0.3.1:445 | tcp | |
| N/A | 10.0.3.2:445 | tcp | |
| N/A | 10.0.3.3:445 | tcp | |
| N/A | 10.0.3.4:445 | tcp | |
| N/A | 10.0.3.5:445 | tcp | |
| N/A | 10.0.3.6:445 | tcp | |
| N/A | 10.0.3.7:445 | tcp | |
| N/A | 10.0.3.8:445 | tcp | |
| N/A | 10.0.3.9:445 | tcp | |
| N/A | 10.0.3.10:445 | tcp | |
| N/A | 10.0.3.11:445 | tcp | |
| N/A | 10.0.3.12:445 | tcp | |
| N/A | 10.0.3.13:445 | tcp | |
| N/A | 10.0.3.14:445 | tcp | |
| N/A | 10.0.3.15:445 | tcp | |
| N/A | 10.0.3.16:445 | tcp | |
| N/A | 10.0.3.17:445 | tcp | |
| N/A | 10.0.3.18:445 | tcp | |
| N/A | 10.0.3.19:445 | tcp | |
| N/A | 10.0.3.20:445 | tcp | |
| N/A | 10.0.3.21:445 | tcp | |
| N/A | 10.0.3.22:445 | tcp | |
| N/A | 10.0.3.23:445 | tcp | |
| N/A | 10.0.3.24:445 | tcp | |
| N/A | 10.0.3.25:445 | tcp | |
| N/A | 10.0.3.26:445 | tcp | |
| N/A | 10.0.3.27:445 | tcp | |
| N/A | 10.0.3.28:445 | tcp | |
| N/A | 10.0.3.29:445 | tcp | |
| N/A | 10.0.3.30:445 | tcp | |
| N/A | 10.0.3.31:445 | tcp | |
| N/A | 10.0.3.32:445 | tcp | |
| N/A | 10.0.3.33:445 | tcp | |
| N/A | 10.0.3.34:445 | tcp | |
| N/A | 10.0.3.35:445 | tcp | |
| N/A | 10.0.3.36:445 | tcp | |
| N/A | 10.0.3.37:445 | tcp | |
| N/A | 10.0.3.38:445 | tcp | |
| N/A | 10.0.3.39:445 | tcp | |
| N/A | 10.0.3.40:445 | tcp | |
| N/A | 10.0.3.41:445 | tcp | |
| N/A | 10.0.3.42:445 | tcp | |
| N/A | 10.0.3.43:445 | tcp | |
| N/A | 10.0.3.44:445 | tcp | |
| N/A | 10.0.3.45:445 | tcp | |
| N/A | 10.0.3.46:445 | tcp | |
| N/A | 10.0.3.47:445 | tcp | |
| N/A | 10.0.3.48:445 | tcp | |
| N/A | 10.0.3.49:445 | tcp | |
| N/A | 10.0.3.50:445 | tcp | |
| N/A | 10.0.3.51:445 | tcp | |
| N/A | 10.0.3.52:445 | tcp | |
| N/A | 10.0.3.53:445 | tcp | |
| N/A | 10.0.3.54:445 | tcp | |
| N/A | 10.0.3.55:445 | tcp | |
| N/A | 10.0.3.56:445 | tcp | |
| N/A | 10.0.3.57:445 | tcp | |
| N/A | 10.0.3.58:445 | tcp | |
| N/A | 10.0.3.59:445 | tcp | |
| N/A | 10.0.3.60:445 | tcp | |
| N/A | 10.0.3.61:445 | tcp | |
| N/A | 10.0.3.62:445 | tcp | |
| N/A | 10.0.3.63:445 | tcp | |
| N/A | 10.0.3.64:445 | tcp | |
| N/A | 10.0.3.65:445 | tcp | |
| N/A | 10.0.3.66:445 | tcp | |
| N/A | 10.0.3.67:445 | tcp | |
| N/A | 10.0.3.68:445 | tcp | |
| N/A | 10.0.3.69:445 | tcp | |
| N/A | 10.0.3.70:445 | tcp | |
| N/A | 10.0.3.71:445 | tcp | |
| N/A | 10.0.3.72:445 | tcp | |
| N/A | 10.0.3.73:445 | tcp | |
| N/A | 10.0.3.74:445 | tcp | |
| N/A | 10.0.3.75:445 | tcp | |
| N/A | 10.0.3.76:445 | tcp | |
| N/A | 10.0.3.77:445 | tcp | |
| N/A | 10.0.3.78:445 | tcp | |
| N/A | 10.0.3.79:445 | tcp | |
| N/A | 10.0.3.80:445 | tcp | |
| N/A | 10.0.3.81:445 | tcp | |
| N/A | 10.0.3.82:445 | tcp | |
| N/A | 10.0.3.83:445 | tcp | |
| N/A | 10.0.3.84:445 | tcp | |
| N/A | 10.0.3.85:445 | tcp | |
| N/A | 10.0.3.86:445 | tcp | |
| N/A | 10.0.3.87:445 | tcp | |
| N/A | 10.0.3.88:445 | tcp | |
| N/A | 10.0.3.89:445 | tcp | |
| N/A | 10.0.3.90:445 | tcp | |
| N/A | 10.0.3.91:445 | tcp | |
| N/A | 10.0.3.92:445 | tcp | |
| N/A | 10.0.3.93:445 | tcp | |
| N/A | 10.0.3.94:445 | tcp | |
| N/A | 10.0.3.95:445 | tcp | |
| N/A | 10.0.3.96:445 | tcp | |
| N/A | 10.0.3.97:445 | tcp | |
| N/A | 10.0.3.98:445 | tcp | |
| N/A | 10.0.3.99:445 | tcp | |
| N/A | 10.0.3.100:445 | tcp | |
| N/A | 10.0.3.101:445 | tcp | |
| N/A | 10.0.3.102:445 | tcp | |
| N/A | 10.0.3.103:445 | tcp | |
| N/A | 10.0.3.104:445 | tcp | |
| N/A | 10.0.3.105:445 | tcp | |
| N/A | 10.0.3.106:445 | tcp | |
| N/A | 10.0.3.107:445 | tcp | |
| N/A | 10.0.3.108:445 | tcp | |
| N/A | 10.0.3.109:445 | tcp | |
| N/A | 10.0.3.110:445 | tcp | |
| N/A | 10.0.3.111:445 | tcp | |
| N/A | 10.0.3.112:445 | tcp | |
| N/A | 10.0.3.113:445 | tcp | |
| N/A | 10.0.3.114:445 | tcp | |
| N/A | 10.0.3.115:445 | tcp | |
| N/A | 10.0.3.116:445 | tcp | |
| N/A | 10.0.3.117:445 | tcp | |
| N/A | 10.0.3.118:445 | tcp | |
| N/A | 10.0.3.119:445 | tcp | |
| N/A | 10.0.3.120:445 | tcp | |
| N/A | 10.0.3.121:445 | tcp | |
| N/A | 10.0.3.122:445 | tcp | |
| N/A | 10.0.3.123:445 | tcp | |
| N/A | 10.0.3.124:445 | tcp | |
| N/A | 10.0.3.125:445 | tcp | |
| N/A | 10.0.3.126:445 | tcp | |
| N/A | 10.0.3.127:445 | tcp | |
| N/A | 10.0.3.128:445 | tcp | |
| N/A | 10.0.3.129:445 | tcp | |
| N/A | 10.0.3.130:445 | tcp | |
| N/A | 10.0.3.131:445 | tcp | |
| N/A | 10.0.3.132:445 | tcp | |
| N/A | 10.0.3.133:445 | tcp | |
| N/A | 10.0.3.134:445 | tcp | |
| N/A | 10.0.3.135:445 | tcp | |
| N/A | 10.0.3.136:445 | tcp | |
| N/A | 10.0.3.137:445 | tcp | |
| N/A | 10.0.3.138:445 | tcp | |
| N/A | 10.0.3.139:445 | tcp | |
| N/A | 10.0.3.140:445 | tcp | |
| N/A | 10.0.3.141:445 | tcp | |
| N/A | 10.0.3.142:445 | tcp | |
| N/A | 10.0.3.143:445 | tcp | |
| N/A | 10.0.3.144:445 | tcp | |
| N/A | 10.0.3.145:445 | tcp | |
| N/A | 10.0.3.146:445 | tcp | |
| N/A | 10.0.3.147:445 | tcp | |
| N/A | 10.0.3.148:445 | tcp | |
| N/A | 10.0.3.149:445 | tcp | |
| N/A | 10.0.3.150:445 | tcp | |
| N/A | 10.0.3.151:445 | tcp | |
| N/A | 10.0.3.152:445 | tcp | |
| N/A | 10.0.3.153:445 | tcp | |
| N/A | 10.0.3.154:445 | tcp | |
| N/A | 10.0.3.155:445 | tcp | |
| N/A | 10.0.3.156:445 | tcp | |
| N/A | 10.0.3.157:445 | tcp | |
| N/A | 10.0.3.158:445 | tcp | |
| N/A | 10.0.3.159:445 | tcp | |
| N/A | 10.0.3.160:445 | tcp | |
| N/A | 10.0.3.161:445 | tcp | |
| N/A | 10.0.3.162:445 | tcp | |
| N/A | 10.0.3.163:445 | tcp | |
| N/A | 10.0.3.164:445 | tcp | |
| N/A | 10.0.3.165:445 | tcp | |
| N/A | 10.0.3.166:445 | tcp | |
| N/A | 10.0.3.167:445 | tcp | |
| N/A | 10.0.3.168:445 | tcp | |
| N/A | 10.0.3.169:445 | tcp | |
| N/A | 10.0.3.170:445 | tcp | |
| N/A | 10.0.3.171:445 | tcp | |
| N/A | 10.0.3.172:445 | tcp | |
| N/A | 10.0.3.173:445 | tcp | |
| N/A | 10.0.3.174:445 | tcp | |
| N/A | 10.0.3.175:445 | tcp | |
| N/A | 10.0.3.176:445 | tcp | |
| N/A | 10.0.3.177:445 | tcp | |
| N/A | 10.0.3.178:445 | tcp | |
| N/A | 10.0.3.179:445 | tcp | |
| N/A | 10.0.3.180:445 | tcp | |
| N/A | 10.0.3.181:445 | tcp | |
| N/A | 10.0.3.182:445 | tcp | |
| N/A | 10.0.3.183:445 | tcp | |
| N/A | 10.0.3.184:445 | tcp | |
| N/A | 10.0.3.185:445 | tcp | |
| N/A | 10.0.3.186:445 | tcp | |
| N/A | 10.0.3.187:445 | tcp | |
| N/A | 10.0.3.188:445 | tcp | |
| N/A | 10.0.3.189:445 | tcp | |
| N/A | 10.0.3.190:445 | tcp | |
| N/A | 10.0.3.191:445 | tcp | |
| N/A | 10.0.3.192:445 | tcp | |
| N/A | 10.0.3.193:445 | tcp | |
| N/A | 10.0.3.194:445 | tcp | |
| N/A | 10.0.3.195:445 | tcp | |
| N/A | 10.0.3.196:445 | tcp | |
| N/A | 10.0.3.197:445 | tcp | |
| N/A | 10.0.3.198:445 | tcp | |
| N/A | 10.0.3.199:445 | tcp | |
| N/A | 10.0.3.200:445 | tcp | |
| N/A | 10.0.3.201:445 | tcp | |
| N/A | 10.0.3.202:445 | tcp | |
| N/A | 10.0.3.203:445 | tcp | |
| N/A | 10.0.3.204:445 | tcp | |
| N/A | 10.0.3.205:445 | tcp | |
| N/A | 10.0.3.206:445 | tcp | |
| N/A | 10.0.3.207:445 | tcp | |
| N/A | 10.0.3.208:445 | tcp | |
| N/A | 10.0.3.209:445 | tcp | |
| N/A | 10.0.3.210:445 | tcp | |
| N/A | 10.0.3.211:445 | tcp | |
| N/A | 10.0.3.212:445 | tcp | |
| N/A | 10.0.3.213:445 | tcp | |
| N/A | 10.0.3.214:445 | tcp | |
| N/A | 10.0.3.215:445 | tcp | |
| N/A | 10.0.3.216:445 | tcp | |
| N/A | 10.0.3.217:445 | tcp | |
| N/A | 10.0.3.218:445 | tcp | |
| N/A | 10.0.3.219:445 | tcp | |
| N/A | 10.0.3.220:445 | tcp | |
| N/A | 10.0.3.221:445 | tcp | |
| N/A | 10.0.3.222:445 | tcp | |
| N/A | 10.0.3.223:445 | tcp | |
| N/A | 10.0.3.224:445 | tcp | |
| N/A | 10.0.3.225:445 | tcp | |
| N/A | 10.0.3.226:445 | tcp | |
| N/A | 10.0.3.227:445 | tcp | |
| N/A | 10.0.3.228:445 | tcp | |
| N/A | 10.0.3.229:445 | tcp | |
| N/A | 10.0.3.230:445 | tcp | |
| N/A | 10.0.3.231:445 | tcp | |
| N/A | 10.0.3.232:445 | tcp | |
| N/A | 10.0.3.233:445 | tcp | |
| N/A | 10.0.3.234:445 | tcp | |
| N/A | 10.0.3.235:445 | tcp | |
| N/A | 10.0.3.236:445 | tcp | |
| N/A | 10.0.3.237:445 | tcp | |
| N/A | 10.0.3.238:445 | tcp | |
| N/A | 10.0.3.239:445 | tcp | |
| N/A | 10.0.3.240:445 | tcp | |
| N/A | 10.0.3.241:445 | tcp | |
| N/A | 10.0.3.242:445 | tcp | |
| N/A | 10.0.3.243:445 | tcp | |
| N/A | 10.0.3.244:445 | tcp | |
| N/A | 10.0.3.245:445 | tcp | |
| N/A | 10.0.3.246:445 | tcp | |
| N/A | 10.0.3.247:445 | tcp | |
| N/A | 10.0.3.248:445 | tcp | |
| N/A | 10.0.3.249:445 | tcp | |
| N/A | 10.0.3.250:445 | tcp | |
| N/A | 10.0.3.251:445 | tcp | |
| N/A | 10.0.3.252:445 | tcp | |
| N/A | 10.0.3.253:445 | tcp | |
| N/A | 10.0.3.254:445 | tcp | |
| N/A | 10.0.3.255:445 | tcp | |
| N/A | 10.0.4.0:445 | tcp | |
| N/A | 10.0.4.1:445 | tcp | |
| N/A | 10.0.4.2:445 | tcp | |
| N/A | 10.0.4.3:445 | tcp | |
| N/A | 10.0.4.4:445 | tcp | |
| N/A | 10.0.4.5:445 | tcp | |
| N/A | 10.0.4.6:445 | tcp | |
| N/A | 10.0.4.7:445 | tcp | |
| N/A | 10.0.4.8:445 | tcp | |
| N/A | 10.0.4.9:445 | tcp | |
| N/A | 10.0.4.10:445 | tcp | |
| N/A | 10.0.4.11:445 | tcp | |
| N/A | 10.0.4.12:445 | tcp | |
| N/A | 10.0.4.13:445 | tcp | |
| N/A | 10.0.4.14:445 | tcp | |
| N/A | 10.0.4.15:445 | tcp | |
| N/A | 10.0.4.16:445 | tcp | |
| N/A | 10.0.4.17:445 | tcp | |
| N/A | 10.0.4.18:445 | tcp | |
| N/A | 10.0.4.19:445 | tcp | |
| N/A | 10.0.4.20:445 | tcp | |
| N/A | 10.0.4.21:445 | tcp | |
| N/A | 10.0.4.22:445 | tcp | |
| N/A | 10.0.4.23:445 | tcp | |
| N/A | 10.0.4.24:445 | tcp | |
| N/A | 10.0.4.25:445 | tcp | |
| N/A | 10.0.4.26:445 | tcp | |
| N/A | 10.0.4.27:445 | tcp | |
| N/A | 10.0.4.28:445 | tcp | |
| N/A | 10.0.4.29:445 | tcp | |
| N/A | 10.0.4.30:445 | tcp | |
| N/A | 10.0.4.31:445 | tcp | |
| N/A | 10.0.4.32:445 | tcp | |
| N/A | 10.0.4.33:445 | tcp | |
| N/A | 10.0.4.34:445 | tcp | |
| N/A | 10.0.4.35:445 | tcp | |
| N/A | 10.0.4.36:445 | tcp | |
| N/A | 10.0.4.37:445 | tcp | |
| N/A | 10.0.4.38:445 | tcp | |
| N/A | 10.0.4.39:445 | tcp | |
| N/A | 10.0.4.40:445 | tcp | |
| N/A | 10.0.4.41:445 | tcp | |
| N/A | 10.0.4.42:445 | tcp | |
| N/A | 10.0.4.43:445 | tcp | |
| N/A | 10.0.4.44:445 | tcp | |
| N/A | 10.0.4.45:445 | tcp | |
| N/A | 10.0.4.46:445 | tcp | |
| N/A | 10.0.4.47:445 | tcp | |
| N/A | 10.0.4.48:445 | tcp | |
| N/A | 10.0.4.49:445 | tcp | |
| N/A | 10.0.4.50:445 | tcp | |
| N/A | 10.0.4.51:445 | tcp | |
| N/A | 10.0.4.52:445 | tcp | |
| N/A | 10.0.4.53:445 | tcp | |
| N/A | 10.0.4.54:445 | tcp | |
| N/A | 10.0.4.55:445 | tcp | |
| N/A | 10.0.4.56:445 | tcp | |
| N/A | 10.0.4.57:445 | tcp | |
| N/A | 10.0.4.58:445 | tcp | |
| N/A | 10.0.4.59:445 | tcp | |
| N/A | 10.0.4.60:445 | tcp | |
| N/A | 10.0.4.61:445 | tcp | |
| N/A | 10.0.4.62:445 | tcp | |
| N/A | 10.0.4.63:445 | tcp | |
| N/A | 10.0.4.64:445 | tcp | |
| N/A | 10.0.4.65:445 | tcp | |
| N/A | 10.0.4.66:445 | tcp | |
| N/A | 10.0.4.67:445 | tcp | |
| N/A | 10.0.4.68:445 | tcp | |
| N/A | 10.0.4.69:445 | tcp | |
| N/A | 10.0.4.70:445 | tcp | |
| N/A | 10.0.4.71:445 | tcp | |
| N/A | 10.0.4.72:445 | tcp | |
| N/A | 10.0.4.73:445 | tcp | |
| N/A | 10.0.4.74:445 | tcp | |
| N/A | 10.0.4.75:445 | tcp | |
| N/A | 10.0.4.76:445 | tcp | |
| N/A | 10.0.4.77:445 | tcp | |
| N/A | 10.0.4.78:445 | tcp | |
| N/A | 10.0.4.79:445 | tcp | |
| N/A | 10.0.4.80:445 | tcp | |
| N/A | 10.0.4.81:445 | tcp | |
| N/A | 10.0.4.82:445 | tcp | |
| N/A | 10.0.4.83:445 | tcp | |
| N/A | 10.0.4.84:445 | tcp | |
| N/A | 10.0.4.85:445 | tcp | |
| N/A | 10.0.4.86:445 | tcp | |
| N/A | 10.0.4.87:445 | tcp | |
| N/A | 10.0.4.88:445 | tcp | |
| N/A | 10.0.4.89:445 | tcp | |
| N/A | 10.0.4.90:445 | tcp | |
| N/A | 10.0.4.91:445 | tcp | |
| N/A | 10.0.4.92:445 | tcp | |
| N/A | 10.0.4.93:445 | tcp | |
| N/A | 10.0.4.94:445 | tcp | |
| N/A | 10.0.4.95:445 | tcp | |
| N/A | 10.0.4.96:445 | tcp | |
| N/A | 10.0.4.97:445 | tcp | |
| N/A | 10.0.4.98:445 | tcp | |
| N/A | 10.0.4.99:445 | tcp | |
| N/A | 10.0.4.100:445 | tcp | |
| N/A | 10.0.4.101:445 | tcp | |
| N/A | 10.0.4.102:445 | tcp | |
| N/A | 10.0.4.103:445 | tcp | |
| N/A | 10.0.4.104:445 | tcp | |
| N/A | 10.0.4.105:445 | tcp | |
| N/A | 10.0.4.106:445 | tcp | |
| N/A | 10.0.4.107:445 | tcp | |
| N/A | 10.0.4.108:445 | tcp | |
| N/A | 10.0.4.109:445 | tcp | |
| N/A | 10.0.4.110:445 | tcp | |
| N/A | 10.0.4.111:445 | tcp | |
| N/A | 10.0.4.112:445 | tcp | |
| N/A | 10.0.4.113:445 | tcp | |
| N/A | 10.0.4.114:445 | tcp | |
| N/A | 10.0.4.115:445 | tcp | |
| N/A | 10.0.4.116:445 | tcp | |
| N/A | 10.0.4.117:445 | tcp | |
| N/A | 10.0.4.118:445 | tcp | |
| N/A | 10.0.4.119:445 | tcp | |
| N/A | 10.0.4.120:445 | tcp | |
| N/A | 10.0.4.121:445 | tcp | |
| N/A | 10.0.4.122:445 | tcp | |
| N/A | 10.0.4.123:445 | tcp | |
| N/A | 10.0.4.124:445 | tcp | |
| N/A | 10.0.4.125:445 | tcp | |
| N/A | 10.0.4.126:445 | tcp | |
| N/A | 10.0.4.127:445 | tcp | |
| N/A | 10.0.4.128:445 | tcp | |
| N/A | 10.0.4.129:445 | tcp | |
| N/A | 10.0.4.130:445 | tcp | |
| N/A | 10.0.4.131:445 | tcp | |
| N/A | 10.0.4.132:445 | tcp | |
| N/A | 10.0.4.133:445 | tcp | |
| N/A | 10.0.4.134:445 | tcp | |
| N/A | 10.0.4.135:445 | tcp | |
| N/A | 10.0.4.136:445 | tcp | |
| N/A | 10.0.4.137:445 | tcp | |
| N/A | 10.0.4.138:445 | tcp | |
| N/A | 10.0.4.139:445 | tcp | |
| N/A | 10.0.4.140:445 | tcp | |
| N/A | 10.0.4.141:445 | tcp | |
| N/A | 10.0.4.142:445 | tcp | |
| N/A | 10.0.4.143:445 | tcp | |
| N/A | 10.0.4.144:445 | tcp | |
| N/A | 10.0.4.145:445 | tcp | |
| N/A | 10.0.4.146:445 | tcp | |
| N/A | 10.0.4.147:445 | tcp | |
| N/A | 10.0.4.148:445 | tcp | |
| N/A | 10.0.4.149:445 | tcp | |
| N/A | 10.0.4.150:445 | tcp | |
| N/A | 10.0.4.151:445 | tcp | |
| N/A | 10.0.4.152:445 | tcp | |
| N/A | 10.0.4.153:445 | tcp | |
| N/A | 10.0.4.154:445 | tcp | |
| N/A | 10.0.4.155:445 | tcp | |
| N/A | 10.0.4.156:445 | tcp | |
| N/A | 10.0.4.157:445 | tcp | |
| N/A | 10.0.4.158:445 | tcp | |
| N/A | 10.0.4.159:445 | tcp | |
| N/A | 10.0.4.160:445 | tcp | |
| N/A | 10.0.4.161:445 | tcp | |
| N/A | 10.0.4.162:445 | tcp | |
| N/A | 10.0.4.163:445 | tcp | |
| N/A | 10.0.4.164:445 | tcp | |
| N/A | 10.0.4.165:445 | tcp | |
| N/A | 10.0.4.166:445 | tcp | |
| N/A | 10.0.4.167:445 | tcp | |
| N/A | 10.0.4.168:445 | tcp | |
| N/A | 10.0.4.169:445 | tcp | |
| N/A | 10.0.4.170:445 | tcp | |
| N/A | 10.0.4.171:445 | tcp | |
| N/A | 10.0.4.172:445 | tcp | |
| N/A | 10.0.4.173:445 | tcp | |
| N/A | 10.0.4.174:445 | tcp | |
| N/A | 10.0.4.175:445 | tcp | |
| N/A | 10.0.4.176:445 | tcp | |
| N/A | 10.0.4.177:445 | tcp | |
| N/A | 10.0.4.178:445 | tcp | |
| N/A | 10.0.4.179:445 | tcp | |
| N/A | 10.0.4.180:445 | tcp | |
| N/A | 10.0.4.181:445 | tcp | |
| N/A | 10.0.4.182:445 | tcp | |
| N/A | 10.0.4.183:445 | tcp | |
| N/A | 10.0.4.184:445 | tcp | |
| N/A | 10.0.4.185:445 | tcp | |
| N/A | 10.0.4.186:445 | tcp | |
| N/A | 10.0.4.187:445 | tcp | |
| N/A | 10.0.4.188:445 | tcp | |
| N/A | 10.0.4.189:445 | tcp | |
| N/A | 10.0.4.190:445 | tcp | |
| N/A | 10.0.4.191:445 | tcp |
Files
memory/2528-0-0x00000000003E0000-0x0000000000A32000-memory.dmp
C:\Windows\security\svchost.exe
| MD5 | 6e350d1e48ed8f2515c30714db2343a2 |
| SHA1 | 4dc58271ae88ccb0014a5dbe89583b96af0b4d0e |
| SHA256 | 2da5fccb18e96468e1c327ae2d2dc072106dfd5f4e1f70ae71d10541221d5c22 |
| SHA512 | 38deabf8ff764c085ddb4fc135434b52627337df59c942ccbf7f423dc9abfa89a7057b32ac138f025325a54da2ff94fd44c2c077528ac81193f2876b728e2010 |
memory/2132-4-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2528-5-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2132-8-0x00000000003E0000-0x0000000000A32000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-22 00:13
Reported
2024-01-22 00:15
Platform
win10v2004-20231222-en
Max time kernel
147s
Max time network
124s
Command Line
Signatures
MetaSploit
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\drivers\sysdrv32.sys | C:\Windows\security\svchost.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\drivers\sysdrv32.sys | C:\Windows\security\svchost.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\drivers\sysdrv32.sys | C:\Windows\security\svchost.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\drivers\sysdrv32.sys | C:\Windows\security\svchost.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\security\svchost.exe | N/A |
Executes dropped EXE
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\security\svchost.exe | C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe | N/A |
| File opened for modification | C:\Windows\security\svchost.exe | C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\security\svchost.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\security\svchost.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\security\svchost.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe
"C:\Users\Admin\AppData\Local\Temp\6e350d1e48ed8f2515c30714db2343a2.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3868 -ip 3868
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1196
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1044 -ip 1044
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 1184
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4248 -ip 4248
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1196
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
C:\Windows\security\svchost.exe
"C:\Windows\security\svchost.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| N/A | 10.0.0.1:445 | tcp | |
| N/A | 10.0.0.1:445 | tcp |
Files
memory/3544-0-0x00000000003E0000-0x0000000000A32000-memory.dmp
C:\Windows\security\svchost.exe
| MD5 | 6e350d1e48ed8f2515c30714db2343a2 |
| SHA1 | 4dc58271ae88ccb0014a5dbe89583b96af0b4d0e |
| SHA256 | 2da5fccb18e96468e1c327ae2d2dc072106dfd5f4e1f70ae71d10541221d5c22 |
| SHA512 | 38deabf8ff764c085ddb4fc135434b52627337df59c942ccbf7f423dc9abfa89a7057b32ac138f025325a54da2ff94fd44c2c077528ac81193f2876b728e2010 |
memory/3716-5-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3544-6-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3716-8-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3448-10-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3448-11-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1184-13-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1184-14-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3416-16-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3416-17-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4952-19-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4952-20-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/864-22-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/864-23-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/5032-25-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/5032-26-0x00000000003E0000-0x0000000000A32000-memory.dmp
C:\Windows\security\svchost.exe
| MD5 | cc5f84a60be521ed0b5b24b254a2d59e |
| SHA1 | e45df273417c13fa674f1f6a5ff36f2040bdd936 |
| SHA256 | 6e39e2fac917e991aa3d0a9bc3eae6847d3187ea0a8e72811adf64a2ac67aad4 |
| SHA512 | 1cac4425f67805566e2ee51d4809ac823e2041f71cff4b0cb9d80b1642548079629b4aa62b57dfc2dcb42ecdc58d4f0b53f522f764e9ab04531b0a5c5bfb5c02 |
memory/4432-28-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4432-29-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/980-31-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/980-32-0x00000000003E0000-0x0000000000A32000-memory.dmp
C:\Windows\security\svchost.exe
| MD5 | 2e4e0ed6cfeb234b036e1743b82a7574 |
| SHA1 | 7273963443fd21bf904532238585ace86ad18c01 |
| SHA256 | 81e34c3533170ce2bfa1736f9abb1a217d6e166b432c953ec70ebe0725d61227 |
| SHA512 | 5f40512d43694d80d90a917f46b3cc6ec75460b05039fc1f2dd93123393f139b855709dfdfa3026bbf72c34bc92e8acb0b1e6c1a829de84bbe30a427578861bf |
memory/1028-34-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1028-35-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4468-37-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4468-38-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/212-40-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/212-41-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2848-43-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2848-44-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2932-46-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2932-47-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1664-49-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1664-50-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2088-52-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2088-53-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3136-55-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3136-56-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3432-58-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3432-59-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4504-61-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4504-62-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3640-64-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3640-65-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4048-67-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/4048-68-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2232-70-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2232-71-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3408-73-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3408-74-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/872-76-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/872-77-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2420-79-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2420-80-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1896-82-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/1896-83-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/768-85-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/768-86-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3128-88-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3128-89-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/956-91-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/956-92-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3860-94-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/3860-95-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2604-97-0x00000000003E0000-0x0000000000A32000-memory.dmp
memory/2604-98-0x00000000003E0000-0x0000000000A32000-memory.dmp
C:\Windows\SysWOW64\drivers\sysdrv32.sys
| MD5 | 0e219b74e2c68a34ca09d8fe114f6d11 |
| SHA1 | 153554e644907d1e4e73b0660a7d0c3213691a6b |
| SHA256 | 163ef2a2f46fa6c20f45e51cbbcd56dcca6032eb791866967013882a25bb3a8f |
| SHA512 | 8a3120729b1e3fd441b83c9866fd2bc548cf2502ff723e2098c2cbddae41dc4a9ff73577bf426b71832fb0ec5e2b7d2a407205371f97a1feb81cb4b481f78f13 |
C:\Windows\SysWOW64\drivers\sysdrv32.sys
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |