Malware Analysis Report

2024-11-30 11:38

Sample ID 240215-gyz9yaaf9s
Target 0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.7z
SHA256 ea0094eec469916f81aa039d87700c88c89f7e10b9c90243127de1c7ad2cfbc0
Tags
lockbit evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea0094eec469916f81aa039d87700c88c89f7e10b9c90243127de1c7ad2cfbc0

Threat Level: Known bad

The file 0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.7z was found to be: Known bad.

Malicious Activity Summary

lockbit evasion persistence ransomware

Lockbit

Modifies boot configuration data using bcdedit

Renames multiple (6400) files with added filename extension

Renames multiple (9003) files with added filename extension

Deletes shadow copies

Deletes backup catalog

Deletes itself

Checks computer location settings

Enumerates connected drives

Adds Run key to start application

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Runs ping.exe

Modifies Control Panel

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-15 06:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-15 06:13

Reported

2024-02-15 06:15

Platform

win7-20231215-en

Max time kernel

40s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

Signatures

Lockbit

ransomware lockbit

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (9003) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe\"" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F4CA.tmp.bmp" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVTEL.DIC C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jre7\Welcome.html C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102594.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXC C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115865.GIF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Windows Mail\de-DE\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\library.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thule C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18194_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01569_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05869_.WMF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\es-ES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN102.XML C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1308 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 1308 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 1308 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 1308 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 2432 wrote to memory of 2316 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2432 wrote to memory of 2316 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2432 wrote to memory of 2316 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2432 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2432 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2432 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2432 wrote to memory of 2440 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 2440 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 2440 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 3028 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 3028 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 3028 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2432 wrote to memory of 2368 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2432 wrote to memory of 2368 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2432 wrote to memory of 2368 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1308 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 1308 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 1308 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 1308 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2416 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2416 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2416 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2416 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 2416 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 2416 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 2416 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe

"C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

Network

Country Destination Domain Proto
N/A 10.127.0.203:445 tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.208:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.231:445 tcp
N/A 10.127.0.250:445 tcp
N/A 10.127.0.237:445 tcp
N/A 10.127.0.253:445 tcp
N/A 10.127.0.251:445 tcp
N/A 10.127.0.249:445 tcp
N/A 10.127.0.248:445 tcp
N/A 10.127.0.246:445 tcp
N/A 10.127.0.214:445 tcp
N/A 10.127.0.245:445 tcp
N/A 10.127.0.213:445 tcp
N/A 10.127.0.244:445 tcp
N/A 10.127.0.212:445 tcp
N/A 10.127.0.243:445 tcp
N/A 10.127.0.211:445 tcp
N/A 10.127.0.242:445 tcp
N/A 10.127.0.210:445 tcp
N/A 10.127.0.241:445 tcp
N/A 10.127.0.209:445 tcp
N/A 10.127.0.240:445 tcp
N/A 10.127.0.239:445 tcp
N/A 10.127.0.207:445 tcp
N/A 10.127.0.206:445 tcp
N/A 10.127.0.205:445 tcp
N/A 10.127.0.238:445 tcp
N/A 10.127.0.204:445 tcp
N/A 10.127.0.202:445 tcp
N/A 10.127.0.201:445 tcp
N/A 10.127.0.199:445 tcp
N/A 10.127.0.200:445 tcp
N/A 10.127.0.236:445 tcp
N/A 10.127.0.198:445 tcp
N/A 10.127.0.197:445 tcp
N/A 10.127.0.196:445 tcp
N/A 10.127.0.195:445 tcp
N/A 10.127.0.235:445 tcp
N/A 10.127.0.194:445 tcp
N/A 10.127.0.193:445 tcp
N/A 10.127.0.192:445 tcp
N/A 10.127.0.191:445 tcp
N/A 10.127.0.234:445 tcp
N/A 10.127.0.190:445 tcp
N/A 10.127.0.189:445 tcp
N/A 10.127.0.188:445 tcp
N/A 10.127.0.233:445 tcp
N/A 10.127.0.187:445 tcp
N/A 10.127.0.186:445 tcp
N/A 10.127.0.185:445 tcp
N/A 10.127.0.232:445 tcp
N/A 10.127.0.184:445 tcp
N/A 10.127.0.183:445 tcp
N/A 10.127.0.182:445 tcp
N/A 10.127.0.181:445 tcp
N/A 10.127.0.180:445 tcp
N/A 10.127.0.179:445 tcp
N/A 10.127.0.178:445 tcp
N/A 10.127.0.230:445 tcp
N/A 10.127.0.177:445 tcp
N/A 10.127.0.175:445 tcp
N/A 10.127.0.176:445 tcp
N/A 10.127.0.174:445 tcp
N/A 10.127.0.229:445 tcp
N/A 10.127.0.173:445 tcp
N/A 10.127.0.172:445 tcp
N/A 10.127.0.171:445 tcp
N/A 10.127.0.228:445 tcp
N/A 10.127.0.170:445 tcp
N/A 10.127.0.168:445 tcp
N/A 10.127.0.169:445 tcp
N/A 10.127.0.167:445 tcp
N/A 10.127.0.227:445 tcp
N/A 10.127.0.166:445 tcp
N/A 10.127.0.165:445 tcp
N/A 10.127.0.164:445 tcp
N/A 10.127.0.226:445 tcp
N/A 10.127.0.163:445 tcp
N/A 10.127.0.162:445 tcp
N/A 10.127.0.161:445 tcp
N/A 10.127.0.225:445 tcp
N/A 10.127.0.160:445 tcp
N/A 10.127.0.159:445 tcp
N/A 10.127.0.158:445 tcp
N/A 10.127.0.224:445 tcp
N/A 10.127.0.157:445 tcp
N/A 10.127.0.223:445 tcp
N/A 10.127.0.156:445 tcp
N/A 10.127.0.222:445 tcp
N/A 10.127.0.155:445 tcp
N/A 10.127.0.154:445 tcp
N/A 10.127.0.221:445 tcp
N/A 10.127.0.220:445 tcp
N/A 10.127.0.153:445 tcp
N/A 10.127.0.152:445 tcp
N/A 10.127.0.219:445 tcp
N/A 10.127.0.218:445 tcp
N/A 10.127.0.217:445 tcp
N/A 10.127.0.151:445 tcp
N/A 10.127.0.150:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.215:445 tcp
N/A 10.127.0.252:445 tcp
N/A 10.127.0.216:445 tcp
N/A 10.127.0.148:445 tcp
N/A 10.127.0.254:445 tcp
N/A 10.127.0.146:445 tcp
N/A 10.127.0.145:445 tcp
N/A 10.127.0.144:445 tcp
N/A 10.127.0.143:445 tcp
N/A 10.127.0.142:445 tcp
N/A 10.127.0.141:445 tcp
N/A 10.127.0.140:445 tcp
N/A 10.127.0.138:445 tcp
N/A 10.127.0.137:445 tcp
N/A 10.127.0.136:445 tcp
N/A 10.127.0.147:445 tcp
N/A 10.127.0.135:445 tcp
N/A 10.127.0.133:445 tcp
N/A 10.127.0.132:445 tcp
N/A 10.127.0.134:445 tcp
N/A 10.127.0.131:445 tcp
N/A 10.127.0.130:445 tcp
N/A 10.127.0.129:445 tcp
N/A 10.127.0.128:445 tcp
N/A 10.127.0.127:445 tcp
N/A 10.127.0.126:445 tcp
N/A 10.127.0.125:445 tcp
N/A 10.127.0.124:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.117:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.78:445 tcp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.70:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.40:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.0:445 tcp
N/A 10.127.0.141:135 tcp
N/A 10.127.0.216:135 tcp
N/A 10.127.0.252:135 tcp
N/A 10.127.0.148:135 tcp
N/A 10.127.0.215:135 tcp
N/A 10.127.0.149:135 tcp
N/A 10.127.0.217:135 tcp
N/A 10.127.0.150:135 tcp
N/A 10.127.0.218:135 tcp
N/A 10.127.0.151:135 tcp
N/A 10.127.0.219:135 tcp
N/A 10.127.0.220:135 tcp
N/A 10.127.0.152:135 tcp
N/A 10.127.0.221:135 tcp
N/A 10.127.0.153:135 tcp
N/A 10.127.0.222:135 tcp
N/A 10.127.0.154:135 tcp
N/A 10.127.0.223:135 tcp
N/A 10.127.0.253:135 tcp
N/A 10.127.0.251:135 tcp
N/A 10.127.0.250:135 tcp
N/A 10.127.0.249:135 tcp
N/A 10.127.0.247:135 tcp
N/A 10.127.0.248:135 tcp
N/A 10.127.0.214:135 tcp
N/A 10.127.0.246:135 tcp
N/A 10.127.0.245:135 tcp
N/A 10.127.0.213:135 tcp
N/A 10.127.0.244:135 tcp
N/A 10.127.0.212:135 tcp
N/A 10.127.0.243:135 tcp
N/A 10.127.0.211:135 tcp
N/A 10.127.0.242:135 tcp
N/A 10.127.0.210:135 tcp
N/A 10.127.0.241:135 tcp
N/A 10.127.0.209:135 tcp
N/A 10.127.0.240:135 tcp
N/A 10.127.0.208:135 tcp
N/A 10.127.0.239:135 tcp
N/A 10.127.0.206:135 tcp
N/A 10.127.0.238:135 tcp
N/A 10.127.0.203:135 tcp
N/A 10.127.0.237:135 tcp
N/A 10.127.0.200:135 tcp
N/A 10.127.0.236:135 tcp
N/A 10.127.0.196:135 tcp
N/A 10.127.0.235:135 tcp
N/A 10.127.0.192:135 tcp
N/A 10.127.0.234:135 tcp
N/A 10.127.0.189:135 tcp
N/A 10.127.0.233:135 tcp
N/A 10.127.0.186:135 tcp
N/A 10.127.0.232:135 tcp
N/A 10.127.0.183:135 tcp
N/A 10.127.0.231:135 tcp
N/A 10.127.0.179:135 tcp
N/A 10.127.0.230:135 tcp
N/A 10.127.0.176:135 tcp
N/A 10.127.0.229:135 tcp
N/A 10.127.0.172:135 tcp
N/A 10.127.0.228:135 tcp
N/A 10.127.0.169:135 tcp
N/A 10.127.0.227:135 tcp
N/A 10.127.0.165:135 tcp
N/A 10.127.0.226:135 tcp
N/A 10.127.0.162:135 tcp
N/A 10.127.0.225:135 tcp
N/A 10.127.0.159:135 tcp
N/A 10.127.0.224:135 tcp
N/A 10.127.0.207:135 tcp
N/A 10.127.0.205:135 tcp
N/A 10.127.0.204:135 tcp
N/A 10.127.0.202:135 tcp
N/A 10.127.0.201:135 tcp
N/A 10.127.0.199:135 tcp
N/A 10.127.0.198:135 tcp
N/A 10.127.0.197:135 tcp
N/A 10.127.0.195:135 tcp
N/A 10.127.0.194:135 tcp
N/A 10.127.0.193:135 tcp
N/A 10.127.0.191:135 tcp
N/A 10.127.0.190:135 tcp
N/A 10.127.0.188:135 tcp
N/A 10.127.0.187:135 tcp
N/A 10.127.0.185:135 tcp
N/A 10.127.0.184:135 tcp
N/A 10.127.0.182:135 tcp
N/A 10.127.0.181:135 tcp
N/A 10.127.0.180:135 tcp
N/A 10.127.0.178:135 tcp
N/A 10.127.0.177:135 tcp
N/A 10.127.0.175:135 tcp
N/A 10.127.0.174:135 tcp
N/A 10.127.0.173:135 tcp
N/A 10.127.0.171:135 tcp
N/A 10.127.0.170:135 tcp
N/A 10.127.0.168:135 tcp
N/A 10.127.0.167:135 tcp
N/A 10.127.0.166:135 tcp
N/A 10.127.0.164:135 tcp
N/A 10.127.0.163:135 tcp
N/A 10.127.0.161:135 tcp
N/A 10.127.0.160:135 tcp
N/A 10.127.0.157:135 tcp
N/A 10.127.0.158:135 tcp
N/A 10.127.0.156:135 tcp
N/A 10.127.0.145:135 tcp
N/A 10.127.0.155:135 tcp
N/A 10.127.0.144:135 tcp
N/A 10.127.0.143:135 tcp
N/A 10.127.0.142:135 tcp
N/A 10.127.0.140:135 tcp
N/A 10.127.0.254:135 tcp
N/A 10.127.0.49:135 tcp
N/A 10.127.0.19:135 tcp
N/A 10.127.0.79:135 tcp
N/A 10.127.0.77:135 tcp
N/A 10.127.0.76:135 tcp
N/A 10.127.0.75:135 tcp
N/A 10.127.0.53:135 tcp
N/A 10.127.0.51:135 tcp
N/A 10.127.0.50:135 tcp
N/A 10.127.0.114:135 tcp
N/A 10.127.0.113:135 tcp
N/A 10.127.0.112:135 tcp
N/A 10.127.0.111:135 tcp
N/A 10.127.0.109:135 tcp
N/A 10.127.0.108:135 tcp
N/A 10.127.0.106:135 tcp
N/A 10.127.0.104:135 tcp
N/A 10.127.0.88:135 tcp
N/A 10.127.0.146:135 tcp
N/A 10.127.0.31:135 tcp
N/A 10.127.0.30:135 tcp
N/A 10.127.0.26:135 tcp
N/A 10.127.0.28:135 tcp
N/A 10.127.0.24:135 tcp
N/A 10.127.0.27:135 tcp
N/A 10.127.0.23:135 tcp
N/A 10.127.0.22:135 tcp
N/A 10.127.0.21:135 tcp
N/A 10.127.0.17:135 tcp
N/A 10.127.0.16:135 tcp
N/A 10.127.0.15:135 tcp
N/A 10.127.0.20:135 tcp
N/A 10.127.0.14:135 tcp
N/A 10.127.0.9:135 tcp
N/A 10.127.0.147:135 tcp
N/A 10.127.0.117:135 tcp
N/A 10.127.0.115:135 tcp
N/A 10.127.0.134:135 tcp
N/A 10.127.0.110:135 tcp
N/A 10.127.0.105:135 tcp
N/A 10.127.0.103:135 tcp
N/A 10.127.0.107:135 tcp
N/A 10.127.0.101:135 tcp
N/A 10.127.0.99:135 tcp
N/A 10.127.0.97:135 tcp
N/A 10.127.0.93:135 tcp
N/A 10.127.0.91:135 tcp
N/A 10.127.0.89:135 tcp
N/A 10.127.0.95:135 tcp
N/A 10.127.0.87:135 tcp
N/A 10.127.0.85:135 tcp
N/A 10.127.0.84:135 tcp
N/A 10.127.0.81:135 tcp
N/A 10.127.0.80:135 tcp
N/A 10.127.0.82:135 tcp
N/A 10.127.0.74:135 tcp
N/A 10.127.0.73:135 tcp
N/A 10.127.0.72:135 tcp
N/A 10.127.0.71:135 tcp
N/A 10.127.0.70:135 tcp
N/A 10.127.0.69:135 tcp
N/A 10.127.0.67:135 tcp
N/A 10.127.0.66:135 tcp
N/A 10.127.0.65:135 tcp
N/A 10.127.0.64:135 tcp
N/A 10.127.0.63:135 tcp
N/A 10.127.0.62:135 tcp
N/A 10.127.0.61:135 tcp
N/A 10.127.0.60:135 tcp
N/A 10.127.0.58:135 tcp
N/A 10.127.0.57:135 tcp
N/A 10.127.0.56:135 tcp
N/A 10.127.0.55:135 tcp
N/A 10.127.0.54:135 tcp
N/A 10.127.0.48:135 tcp
N/A 10.127.0.47:135 tcp
N/A 10.127.0.46:135 tcp
N/A 10.127.0.45:135 tcp
N/A 10.127.0.44:135 tcp
N/A 10.127.0.42:135 tcp
N/A 10.127.0.41:135 tcp
N/A 10.127.0.40:135 tcp
N/A 10.127.0.39:135 tcp
N/A 10.127.0.38:135 tcp
N/A 10.127.0.37:135 tcp
N/A 10.127.0.35:135 tcp
N/A 10.127.0.34:135 tcp
N/A 10.127.0.33:135 tcp
N/A 10.127.0.32:135 tcp
N/A 10.127.0.131:135 tcp
N/A 10.127.0.130:135 tcp
N/A 10.127.0.129:135 tcp
N/A 10.127.0.128:135 tcp
N/A 10.127.0.127:135 tcp
N/A 10.127.0.126:135 tcp
N/A 10.127.0.125:135 tcp
N/A 10.127.0.124:135 tcp
N/A 10.127.0.123:135 tcp
N/A 10.127.0.122:135 tcp
N/A 10.127.0.121:135 tcp
N/A 10.127.0.120:135 tcp
N/A 10.127.0.119:135 tcp
N/A 10.127.0.118:135 tcp
N/A 10.127.0.116:135 tcp
N/A 10.127.0.102:135 tcp
N/A 10.127.0.100:135 tcp
N/A 10.127.0.98:135 tcp
N/A 10.127.0.96:135 tcp
N/A 10.127.0.94:135 tcp
N/A 10.127.0.92:135 tcp
N/A 10.127.0.90:135 tcp
N/A 10.127.0.86:135 tcp
N/A 10.127.0.83:135 tcp
N/A 10.127.0.78:135 tcp
N/A 10.127.0.68:135 tcp
N/A 10.127.0.59:135 tcp
N/A 10.127.0.52:135 tcp
N/A 10.127.0.43:135 tcp
N/A 10.127.0.36:135 tcp
N/A 10.127.0.29:135 tcp
N/A 10.127.0.25:135 tcp
N/A 10.127.0.18:135 tcp
N/A 10.127.0.13:135 tcp
N/A 10.127.0.12:135 tcp
N/A 10.127.0.11:135 tcp
N/A 10.127.0.10:135 tcp
N/A 10.127.0.7:135 tcp
N/A 10.127.0.6:135 tcp
N/A 10.127.0.138:135 tcp
N/A 10.127.0.137:135 tcp
N/A 10.127.0.136:135 tcp
N/A 10.127.0.135:135 tcp
N/A 10.127.0.133:135 tcp
N/A 10.127.0.132:135 tcp
N/A 10.127.0.4:135 tcp
N/A 10.127.0.8:135 tcp
N/A 10.127.0.3:135 tcp
N/A 10.127.0.5:135 tcp
N/A 10.127.0.1:135 tcp
N/A 10.127.0.2:135 tcp
N/A 10.127.0.0:135 tcp

Files

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

MD5 e4401679c6e88dca4347c58c2481d2c4
SHA1 ca21fad7590c3f1bfa0b1aaf075b593e458010ab
SHA256 18913802aeb457f02c02291991ead0cd95d22d8705f571a564c5ec3a664de032
SHA512 8f88ee3ddf46f7f0f9164f965f965a61ddf8c90accdfcfa156fdb7cf0ed6d7ca0b41feec4ad2a9a76be9c6022ca5eadac9ee82aeca3aebb5f6929dd3e1215ff3

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-15 06:13

Reported

2024-02-15 06:33

Platform

win10v2004-20231215-en

Max time kernel

1014s

Max time network

1172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

Signatures

Lockbit

ransomware lockbit

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6400) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe\"" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9BDD.tmp.bmp" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlFrontIndicator.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\jit_moments.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-300.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\shared.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-60_contrast-black.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-400.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls\MsaAuthenticatorView.xaml C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 4476 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\System32\cmd.exe
PID 2556 wrote to memory of 3712 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2556 wrote to memory of 3712 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2556 wrote to memory of 1560 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2556 wrote to memory of 1560 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2556 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2556 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2556 wrote to memory of 2724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2556 wrote to memory of 2724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2556 wrote to memory of 2396 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2556 wrote to memory of 2396 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4476 wrote to memory of 5972 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 5972 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 5972 N/A C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe C:\Windows\SysWOW64\cmd.exe
PID 5972 wrote to memory of 6036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5972 wrote to memory of 6036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5972 wrote to memory of 6036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5972 wrote to memory of 6084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 5972 wrote to memory of 6084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 5972 wrote to memory of 6084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe

"C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.152:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.78:445 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.117:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.128:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.125:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.129:445 tcp
N/A 10.127.0.155:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.130:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.40:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.0:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.127:445 tcp
N/A 10.127.0.126:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.124:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.131:445 tcp
N/A 10.127.0.132:445 tcp
N/A 10.127.0.133:445 tcp
N/A 10.127.0.134:445 tcp
N/A 10.127.0.135:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.136:445 tcp
N/A 10.127.0.137:445 tcp
N/A 10.127.0.138:445 tcp
N/A 10.127.0.139:445 tcp
N/A 10.127.0.253:445 tcp
N/A 10.127.0.140:445 tcp
N/A 10.127.0.141:445 tcp
N/A 10.127.0.143:445 tcp
N/A 10.127.0.142:445 tcp
N/A 10.127.0.144:445 tcp
N/A 10.127.0.145:445 tcp
N/A 10.127.0.146:445 tcp
N/A 10.127.0.147:445 tcp
N/A 10.127.0.148:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.150:445 tcp
N/A 10.127.0.151:445 tcp
N/A 10.127.0.154:445 tcp
N/A 10.127.0.157:445 tcp
N/A 10.127.0.156:445 tcp
N/A 10.127.0.158:445 tcp
N/A 10.127.0.160:445 tcp
N/A 10.127.0.159:445 tcp
N/A 10.127.0.161:445 tcp
N/A 10.127.0.162:445 tcp
N/A 10.127.0.163:445 tcp
N/A 10.127.0.164:445 tcp
N/A 10.127.0.166:445 tcp
N/A 10.127.0.165:445 tcp
N/A 10.127.0.168:445 tcp
N/A 10.127.0.169:445 tcp
N/A 10.127.0.167:445 tcp
N/A 10.127.0.170:445 tcp
N/A 10.127.0.171:445 tcp
N/A 10.127.0.172:445 tcp
N/A 10.127.0.173:445 tcp
N/A 10.127.0.174:445 tcp
N/A 10.127.0.177:445 tcp
N/A 10.127.0.175:445 tcp
N/A 10.127.0.176:445 tcp
N/A 10.127.0.178:445 tcp
N/A 10.127.0.179:445 tcp
N/A 10.127.0.180:445 tcp
N/A 10.127.0.181:445 tcp
N/A 10.127.0.182:445 tcp
N/A 10.127.0.184:445 tcp
N/A 10.127.0.185:445 tcp
N/A 10.127.0.183:445 tcp
N/A 10.127.0.186:445 tcp
N/A 10.127.0.189:445 tcp
N/A 10.127.0.187:445 tcp
N/A 10.127.0.188:445 tcp
N/A 10.127.0.190:445 tcp
N/A 10.127.0.193:445 tcp
N/A 10.127.0.191:445 tcp
N/A 10.127.0.192:445 tcp
N/A 10.127.0.194:445 tcp
N/A 10.127.0.195:445 tcp
N/A 10.127.0.196:445 tcp
N/A 10.127.0.197:445 tcp
N/A 10.127.0.199:445 tcp
N/A 10.127.0.198:445 tcp
N/A 10.127.0.200:445 tcp
N/A 10.127.0.202:445 tcp
N/A 10.127.0.201:445 tcp
N/A 10.127.0.203:445 tcp
N/A 10.127.0.205:445 tcp
N/A 10.127.0.204:445 tcp
N/A 10.127.0.206:445 tcp
N/A 10.127.0.208:445 tcp
N/A 10.127.0.207:445 tcp
N/A 10.127.0.211:445 tcp
N/A 10.127.0.209:445 tcp
N/A 10.127.0.212:445 tcp
N/A 10.127.0.210:445 tcp
N/A 10.127.0.213:445 tcp
N/A 10.127.0.215:445 tcp
N/A 10.127.0.214:445 tcp
N/A 10.127.0.217:445 tcp
N/A 10.127.0.216:445 tcp
N/A 10.127.0.218:445 tcp
N/A 10.127.0.219:445 tcp
N/A 10.127.0.222:445 tcp
N/A 10.127.0.220:445 tcp
N/A 10.127.0.221:445 tcp
N/A 10.127.0.223:445 tcp
N/A 10.127.0.224:445 tcp
N/A 10.127.0.226:445 tcp
N/A 10.127.0.227:445 tcp
N/A 10.127.0.225:445 tcp
N/A 10.127.0.229:445 tcp
N/A 10.127.0.228:445 tcp
N/A 10.127.0.231:445 tcp
N/A 10.127.0.230:445 tcp
N/A 10.127.0.232:445 tcp
N/A 10.127.0.234:445 tcp
N/A 10.127.0.233:445 tcp
N/A 10.127.0.235:445 tcp
N/A 10.127.0.236:445 tcp
N/A 10.127.0.237:445 tcp
N/A 10.127.0.238:445 tcp
N/A 10.127.0.239:445 tcp
N/A 10.127.0.242:445 tcp
N/A 10.127.0.241:445 tcp
N/A 10.127.0.240:445 tcp
N/A 10.127.0.243:445 tcp
N/A 10.127.0.245:445 tcp
N/A 10.127.0.244:445 tcp
N/A 10.127.0.246:445 tcp
N/A 10.127.0.252:445 tcp
N/A 10.127.0.250:445 tcp
N/A 10.127.0.248:445 tcp
N/A 10.127.0.251:445 tcp
N/A 10.127.0.249:445 tcp
N/A 10.127.0.254:445 tcp
N/A 10.127.0.153:445 tcp
N/A 10.127.0.148:135 tcp
N/A 10.127.0.147:135 tcp
N/A 10.127.0.146:135 tcp
N/A 10.127.0.145:135 tcp
N/A 10.127.0.144:135 tcp
N/A 10.127.0.142:135 tcp
N/A 10.127.0.143:135 tcp
N/A 10.127.0.141:135 tcp
N/A 10.127.0.140:135 tcp
N/A 10.127.0.253:135 tcp
N/A 10.127.0.139:135 tcp
N/A 10.127.0.138:135 tcp
N/A 10.127.0.137:135 tcp
N/A 10.127.0.136:135 tcp
N/A 10.127.0.247:135 tcp
N/A 10.127.0.135:135 tcp
N/A 10.127.0.134:135 tcp
N/A 10.127.0.132:135 tcp
N/A 10.127.0.131:135 tcp
N/A 10.127.0.133:135 tcp
N/A 10.127.0.130:135 tcp
N/A 10.127.0.129:135 tcp
N/A 10.127.0.128:135 tcp
N/A 10.127.0.127:135 tcp
N/A 10.127.0.126:135 tcp
N/A 10.127.0.125:135 tcp
N/A 10.127.0.123:135 tcp
N/A 10.127.0.124:135 tcp
N/A 10.127.0.0:135 tcp
N/A 10.127.0.1:135 tcp
N/A 10.127.0.2:135 tcp
N/A 10.127.0.3:135 tcp
N/A 10.127.0.4:135 tcp
N/A 10.127.0.5:135 tcp
N/A 10.127.0.6:135 tcp
N/A 10.127.0.7:135 tcp
N/A 10.127.0.9:135 tcp
N/A 10.127.0.8:135 tcp
N/A 10.127.0.10:135 tcp
N/A 10.127.0.11:135 tcp
N/A 10.127.0.12:135 tcp
N/A 10.127.0.13:135 tcp
N/A 10.127.0.14:135 tcp
N/A 10.127.0.16:135 tcp
N/A 10.127.0.15:135 tcp
N/A 10.127.0.17:135 tcp
N/A 10.127.0.18:135 tcp
N/A 10.127.0.20:135 tcp
N/A 10.127.0.19:135 tcp
N/A 10.127.0.21:135 tcp
N/A 10.127.0.22:135 tcp
N/A 10.127.0.23:135 tcp
N/A 10.127.0.24:135 tcp
N/A 10.127.0.25:135 tcp
N/A 10.127.0.26:135 tcp
N/A 10.127.0.27:135 tcp
N/A 10.127.0.28:135 tcp
N/A 10.127.0.29:135 tcp
N/A 10.127.0.122:135 tcp
N/A 10.127.0.30:135 tcp
N/A 10.127.0.32:135 tcp
N/A 10.127.0.33:135 tcp
N/A 10.127.0.34:135 tcp
N/A 10.127.0.35:135 tcp
N/A 10.127.0.36:135 tcp
N/A 10.127.0.37:135 tcp
N/A 10.127.0.38:135 tcp
N/A 10.127.0.39:135 tcp
N/A 10.127.0.40:135 tcp
N/A 10.127.0.41:135 tcp
N/A 10.127.0.43:135 tcp
N/A 10.127.0.42:135 tcp
N/A 10.127.0.121:135 tcp
N/A 10.127.0.118:135 tcp
N/A 10.127.0.117:135 tcp
N/A 10.127.0.116:135 tcp
N/A 10.127.0.114:135 tcp
N/A 10.127.0.115:135 tcp
N/A 10.127.0.112:135 tcp
N/A 10.127.0.113:135 tcp
N/A 10.127.0.111:135 tcp
N/A 10.127.0.110:135 tcp
N/A 10.127.0.108:135 tcp
N/A 10.127.0.107:135 tcp
N/A 10.127.0.109:135 tcp
N/A 10.127.0.106:135 tcp
N/A 10.127.0.105:135 tcp
N/A 10.127.0.104:135 tcp
N/A 10.127.0.102:135 tcp
N/A 10.127.0.101:135 tcp
N/A 10.127.0.99:135 tcp
N/A 10.127.0.100:135 tcp
N/A 10.127.0.98:135 tcp
N/A 10.127.0.97:135 tcp
N/A 10.127.0.95:135 tcp
N/A 10.127.0.96:135 tcp
N/A 10.127.0.94:135 tcp
N/A 10.127.0.93:135 tcp
N/A 10.127.0.92:135 tcp
N/A 10.127.0.91:135 tcp
N/A 10.127.0.90:135 tcp
N/A 10.127.0.89:135 tcp
N/A 10.127.0.88:135 tcp
N/A 10.127.0.86:135 tcp
N/A 10.127.0.85:135 tcp
N/A 10.127.0.87:135 tcp
N/A 10.127.0.83:135 tcp
N/A 10.127.0.82:135 tcp
N/A 10.127.0.80:135 tcp
N/A 10.127.0.84:135 tcp
N/A 10.127.0.81:135 tcp
N/A 10.127.0.78:135 tcp
N/A 10.127.0.79:135 tcp
N/A 10.127.0.77:135 tcp
N/A 10.127.0.76:135 tcp
N/A 10.127.0.75:135 tcp
N/A 10.127.0.74:135 tcp
N/A 10.127.0.73:135 tcp
N/A 10.127.0.72:135 tcp
N/A 10.127.0.71:135 tcp
N/A 10.127.0.69:135 tcp
N/A 10.127.0.119:135 tcp
N/A 10.127.0.68:135 tcp
N/A 10.127.0.67:135 tcp
N/A 10.127.0.120:135 tcp
N/A 10.127.0.65:135 tcp
N/A 10.127.0.66:135 tcp
N/A 10.127.0.63:135 tcp
N/A 10.127.0.64:135 tcp
N/A 10.127.0.62:135 tcp
N/A 10.127.0.61:135 tcp
N/A 10.127.0.60:135 tcp
N/A 10.127.0.59:135 tcp
N/A 10.127.0.57:135 tcp
N/A 10.127.0.58:135 tcp
N/A 10.127.0.56:135 tcp
N/A 10.127.0.55:135 tcp
N/A 10.127.0.54:135 tcp
N/A 10.127.0.53:135 tcp
N/A 10.127.0.44:135 tcp
N/A 10.127.0.52:135 tcp
N/A 10.127.0.155:135 tcp
N/A 10.127.0.51:135 tcp
N/A 10.127.0.50:135 tcp
N/A 10.127.0.49:135 tcp
N/A 10.127.0.48:135 tcp
N/A 10.127.0.46:135 tcp
N/A 10.127.0.47:135 tcp
N/A 10.127.0.45:135 tcp
N/A 10.127.0.149:135 tcp
N/A 10.127.0.150:135 tcp
N/A 10.127.0.151:135 tcp
N/A 10.127.0.154:135 tcp
N/A 10.127.0.157:135 tcp
N/A 10.127.0.156:135 tcp
N/A 10.127.0.158:135 tcp
N/A 10.127.0.160:135 tcp
N/A 10.127.0.159:135 tcp
N/A 10.127.0.161:135 tcp
N/A 10.127.0.163:135 tcp
N/A 10.127.0.162:135 tcp
N/A 10.127.0.164:135 tcp
N/A 10.127.0.166:135 tcp
N/A 10.127.0.165:135 tcp
N/A 10.127.0.168:135 tcp
N/A 10.127.0.169:135 tcp
N/A 10.127.0.167:135 tcp
N/A 10.127.0.170:135 tcp
N/A 10.127.0.171:135 tcp
N/A 10.127.0.172:135 tcp
N/A 10.127.0.173:135 tcp
N/A 10.127.0.174:135 tcp
N/A 10.127.0.177:135 tcp
N/A 10.127.0.175:135 tcp
N/A 10.127.0.176:135 tcp
N/A 10.127.0.178:135 tcp
N/A 10.127.0.179:135 tcp
N/A 10.127.0.180:135 tcp
N/A 10.127.0.181:135 tcp
N/A 10.127.0.182:135 tcp
N/A 10.127.0.184:135 tcp
N/A 10.127.0.185:135 tcp
N/A 10.127.0.183:135 tcp
N/A 10.127.0.186:135 tcp
N/A 10.127.0.189:135 tcp
N/A 10.127.0.187:135 tcp
N/A 10.127.0.188:135 tcp
N/A 10.127.0.190:135 tcp
N/A 10.127.0.193:135 tcp
N/A 10.127.0.191:135 tcp
N/A 10.127.0.192:135 tcp
N/A 10.127.0.194:135 tcp
N/A 10.127.0.195:135 tcp
N/A 10.127.0.197:135 tcp
N/A 10.127.0.196:135 tcp
N/A 10.127.0.199:135 tcp
N/A 10.127.0.198:135 tcp
N/A 10.127.0.200:135 tcp
N/A 10.127.0.202:135 tcp
N/A 10.127.0.201:135 tcp
N/A 10.127.0.203:135 tcp
N/A 10.127.0.205:135 tcp
N/A 10.127.0.204:135 tcp
N/A 10.127.0.206:135 tcp
N/A 10.127.0.208:135 tcp
N/A 10.127.0.207:135 tcp
N/A 10.127.0.211:135 tcp
N/A 10.127.0.212:135 tcp
N/A 10.127.0.209:135 tcp
N/A 10.127.0.210:135 tcp
N/A 10.127.0.213:135 tcp
N/A 10.127.0.215:135 tcp
N/A 10.127.0.214:135 tcp
N/A 10.127.0.217:135 tcp
N/A 10.127.0.216:135 tcp
N/A 10.127.0.218:135 tcp
N/A 10.127.0.219:135 tcp
N/A 10.127.0.222:135 tcp
N/A 10.127.0.220:135 tcp
N/A 10.127.0.223:135 tcp
N/A 10.127.0.221:135 tcp
N/A 10.127.0.224:135 tcp
N/A 10.127.0.103:135 tcp
N/A 10.127.0.226:135 tcp
N/A 10.127.0.31:135 tcp
N/A 10.127.0.152:135 tcp
N/A 10.127.0.227:135 tcp
N/A 10.127.0.251:135 tcp
N/A 10.127.0.153:135 tcp
N/A 10.127.0.254:135 tcp
N/A 10.127.0.248:135 tcp
N/A 10.127.0.249:135 tcp
N/A 10.127.0.250:135 tcp
N/A 10.127.0.252:135 tcp
N/A 10.127.0.241:135 tcp
N/A 10.127.0.244:135 tcp
N/A 10.127.0.246:135 tcp
N/A 10.127.0.243:135 tcp
N/A 10.127.0.245:135 tcp
N/A 10.127.0.240:135 tcp
N/A 10.127.0.239:135 tcp
N/A 10.127.0.242:135 tcp
N/A 10.127.0.238:135 tcp
N/A 10.127.0.235:135 tcp
N/A 10.127.0.237:135 tcp
N/A 10.127.0.236:135 tcp
N/A 10.127.0.233:135 tcp
N/A 10.127.0.234:135 tcp
N/A 10.127.0.232:135 tcp
N/A 10.127.0.230:135 tcp
N/A 10.127.0.228:135 tcp
N/A 10.127.0.231:135 tcp
N/A 10.127.0.225:135 tcp
N/A 10.127.0.229:135 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp

Files

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Restore-My-Files.txt

MD5 b59ac86be4e3fef71254a259cb5249ac
SHA1 ea27c80e3212302e57895d47b825bdde0e0a02e3
SHA256 370edcb4667120f812f6704b261a448b33bc0657b5e284285b95b091e6fcbe67
SHA512 226c9a78dca1360862d96233edc0e43bb68edf47f17f8a5eaef7852d2340ce48f652eeb7c92fa92d9793366200cc05be2b4bbc2532aa2d8070deb2dd0f87aba3