Malware Analysis Report

2024-11-13 14:58

Sample ID 240314-ezlrtscf44
Target cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1
SHA256 cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1
Tags
lockbit evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1

Threat Level: Known bad

The file cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1 was found to be: Known bad.

Malicious Activity Summary

lockbit evasion persistence ransomware

Detects command variations typically used by ransomware

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

Lockbit

Detects executables containing many references to VEEAM. Observed in ransomware

Detects executables containing commands for clearing Windows Event Logs

Modifies boot configuration data using bcdedit

Renames multiple (9347) files with added filename extension

Renames multiple (14187) files with added filename extension

Deletes shadow copies

Deletes backup catalog

Deletes itself

Checks computer location settings

Adds Run key to start application

Enumerates connected drives

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Modifies Control Panel

Suspicious use of WriteProcessMemory

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:22

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Description Indicator Process Target
N/A N/A N/A N/A

Detects command variations typically used by ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing commands for clearing Windows Event Logs

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing many references to VEEAM. Observed in ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:22

Reported

2024-03-14 04:25

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

Signatures

Lockbit

ransomware lockbit

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (9347) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe\"" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5F40.tmp.bmp" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_OFF.GIF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01395_.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Technic.eftx.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXT.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296288.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImagesMask16x16.bmp.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.DPV.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282928.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212751.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2320 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2320 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2320 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2700 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2700 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2700 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2700 wrote to memory of 1404 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2700 wrote to memory of 1404 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2700 wrote to memory of 1404 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2700 wrote to memory of 808 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 808 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 808 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2700 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2700 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2700 wrote to memory of 3044 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2320 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 1636 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 1636 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 1636 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 1636 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe

"C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

Network

Country Destination Domain Proto
N/A 10.127.0.212:445 tcp
N/A 10.127.0.201:445 tcp
N/A 10.127.0.213:445 tcp
N/A 10.127.0.231:445 tcp
N/A 10.127.0.195:445 tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.245:445 tcp
N/A 10.127.0.238:445 tcp
N/A 10.127.0.235:445 tcp
N/A 10.127.0.221:445 tcp
N/A 10.127.0.243:445 tcp
N/A 10.127.0.200:445 tcp
N/A 10.127.0.199:445 tcp
N/A 10.127.0.220:445 tcp
N/A 10.127.0.196:445 tcp
N/A 10.127.0.230:445 tcp
N/A 10.127.0.206:445 tcp
N/A 10.127.0.229:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.244:445 tcp
N/A 10.127.0.227:445 tcp
N/A 10.127.0.216:445 tcp
N/A 10.127.0.228:445 tcp
N/A 10.127.0.208:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.240:445 tcp
N/A 10.127.0.225:445 tcp
N/A 10.127.0.198:445 tcp
N/A 10.127.0.237:445 tcp
N/A 10.127.0.203:445 tcp
N/A 10.127.0.248:445 tcp
N/A 10.127.0.219:445 tcp
N/A 10.127.0.204:445 tcp
N/A 10.127.0.241:445 tcp
N/A 10.127.0.249:445 tcp
N/A 10.127.0.232:445 tcp
N/A 10.127.0.209:445 tcp
N/A 10.127.0.223:445 tcp
N/A 10.127.0.236:445 tcp
N/A 10.127.0.242:445 tcp
N/A 10.127.0.239:445 tcp
N/A 10.127.0.197:445 tcp
N/A 10.127.0.193:445 tcp
N/A 10.127.0.191:445 tcp
N/A 10.127.0.211:445 tcp
N/A 10.127.0.210:445 tcp
N/A 10.127.0.252:445 tcp
N/A 10.127.0.226:445 tcp
N/A 10.127.0.218:445 tcp
N/A 10.127.0.194:445 tcp
N/A 10.127.0.188:445 tcp
N/A 10.127.0.234:445 tcp
N/A 10.127.0.215:445 tcp
N/A 10.127.0.222:445 tcp
N/A 10.127.0.253:445 tcp
N/A 10.127.0.254:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.202:445 tcp
N/A 10.127.0.250:445 tcp
N/A 10.127.0.233:445 tcp
N/A 10.127.0.189:445 tcp
N/A 10.127.0.192:445 tcp
N/A 10.127.0.207:445 tcp
N/A 10.127.0.190:445 tcp
N/A 10.127.0.214:445 tcp
N/A 10.127.0.136:445 tcp
N/A 10.127.0.217:445 tcp
N/A 10.127.0.185:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.251:445 tcp
N/A 10.127.0.224:445 tcp
N/A 10.127.0.205:445 tcp
N/A 10.127.0.160:445 tcp
N/A 10.127.0.141:445 tcp
N/A 10.127.0.168:445 tcp
N/A 10.127.0.137:445 tcp
N/A 10.127.0.246:445 tcp
N/A 10.127.0.155:445 tcp
N/A 10.127.0.172:445 tcp
N/A 10.127.0.145:445 tcp
N/A 10.127.0.182:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.150:445 tcp
N/A 10.127.0.166:445 tcp
N/A 10.127.0.165:445 tcp
N/A 10.127.0.139:445 tcp
N/A 10.127.0.138:445 tcp
N/A 10.127.0.135:445 tcp
N/A 10.127.0.162:445 tcp
N/A 10.127.0.159:445 tcp
N/A 10.127.0.158:445 tcp
N/A 10.127.0.147:445 tcp
N/A 10.127.0.186:445 tcp
N/A 10.127.0.178:445 tcp
N/A 10.127.0.148:445 tcp
N/A 10.127.0.146:445 tcp
N/A 10.127.0.174:445 tcp
N/A 10.127.0.171:445 tcp
N/A 10.127.0.140:445 tcp
N/A 10.127.0.164:445 tcp
N/A 10.127.0.151:445 tcp
N/A 10.127.0.176:445 tcp
N/A 10.127.0.177:445 tcp
N/A 10.127.0.187:445 tcp
N/A 10.127.0.134:445 tcp
N/A 10.127.0.153:445 tcp
N/A 10.127.0.184:445 tcp
N/A 10.127.0.183:445 tcp
N/A 10.127.0.181:445 tcp
N/A 10.127.0.180:445 tcp
N/A 10.127.0.179:445 tcp
N/A 10.127.0.175:445 tcp
N/A 10.127.0.173:445 tcp
N/A 10.127.0.170:445 tcp
N/A 10.127.0.169:445 tcp
N/A 10.127.0.167:445 tcp
N/A 10.127.0.163:445 tcp
N/A 10.127.0.161:445 tcp
N/A 10.127.0.157:445 tcp
N/A 10.127.0.156:445 tcp
N/A 10.127.0.154:445 tcp
N/A 10.127.0.152:445 tcp
N/A 10.127.0.144:445 tcp
N/A 10.127.0.143:445 tcp
N/A 10.127.0.142:445 tcp
N/A 10.127.0.133:445 tcp
N/A 10.127.0.132:445 tcp
N/A 10.127.0.131:445 tcp
N/A 10.127.0.129:445 tcp
N/A 10.127.0.130:445 tcp
N/A 10.127.0.128:445 tcp
N/A 10.127.0.126:445 tcp
N/A 10.127.0.125:445 tcp
N/A 10.127.0.127:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.124:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.78:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.70:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.40:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.0:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.254:135 tcp
N/A 10.127.0.234:135 tcp
N/A 10.127.0.235:135 tcp
N/A 10.127.0.238:135 tcp
N/A 10.127.0.240:135 tcp
N/A 10.127.0.247:135 tcp
N/A 10.127.0.239:135 tcp
N/A 10.127.0.248:135 tcp
N/A 10.127.0.249:135 tcp
N/A 10.127.0.241:135 tcp
N/A 10.127.0.242:135 tcp
N/A 10.127.0.250:135 tcp
N/A 10.127.0.243:135 tcp
N/A 10.127.0.251:135 tcp
N/A 10.127.0.252:135 tcp
N/A 10.127.0.244:135 tcp
N/A 10.127.0.245:135 tcp
N/A 10.127.0.253:135 tcp
N/A 10.127.0.133:135 tcp
N/A 10.127.0.135:135 tcp
N/A 10.127.0.134:135 tcp
N/A 10.127.0.136:135 tcp
N/A 10.127.0.137:135 tcp
N/A 10.127.0.140:135 tcp
N/A 10.127.0.139:135 tcp
N/A 10.127.0.141:135 tcp
N/A 10.127.0.138:135 tcp
N/A 10.127.0.142:135 tcp
N/A 10.127.0.157:135 tcp
N/A 10.127.0.143:135 tcp
N/A 10.127.0.159:135 tcp
N/A 10.127.0.161:135 tcp
N/A 10.127.0.144:135 tcp
N/A 10.127.0.163:135 tcp
N/A 10.127.0.146:135 tcp
N/A 10.127.0.165:135 tcp
N/A 10.127.0.167:135 tcp
N/A 10.127.0.145:135 tcp
N/A 10.127.0.169:135 tcp
N/A 10.127.0.148:135 tcp
N/A 10.127.0.170:135 tcp
N/A 10.127.0.190:135 tcp
N/A 10.127.0.147:135 tcp
N/A 10.127.0.192:135 tcp
N/A 10.127.0.195:135 tcp
N/A 10.127.0.150:135 tcp
N/A 10.127.0.197:135 tcp
N/A 10.127.0.149:135 tcp
N/A 10.127.0.199:135 tcp
N/A 10.127.0.200:135 tcp
N/A 10.127.0.152:135 tcp
N/A 10.127.0.202:135 tcp
N/A 10.127.0.151:135 tcp
N/A 10.127.0.232:135 tcp
N/A 10.127.0.230:135 tcp
N/A 10.127.0.228:135 tcp
N/A 10.127.0.226:135 tcp
N/A 10.127.0.224:135 tcp
N/A 10.127.0.222:135 tcp
N/A 10.127.0.219:135 tcp
N/A 10.127.0.217:135 tcp
N/A 10.127.0.215:135 tcp
N/A 10.127.0.213:135 tcp
N/A 10.127.0.211:135 tcp
N/A 10.127.0.209:135 tcp
N/A 10.127.0.207:135 tcp
N/A 10.127.0.205:135 tcp
N/A 10.127.0.201:135 tcp
N/A 10.127.0.203:135 tcp
N/A 10.127.0.198:135 tcp
N/A 10.127.0.196:135 tcp
N/A 10.127.0.194:135 tcp
N/A 10.127.0.193:135 tcp
N/A 10.127.0.191:135 tcp
N/A 10.127.0.189:135 tcp
N/A 10.127.0.188:135 tcp
N/A 10.127.0.187:135 tcp
N/A 10.127.0.183:135 tcp
N/A 10.127.0.186:135 tcp
N/A 10.127.0.185:135 tcp
N/A 10.127.0.184:135 tcp
N/A 10.127.0.181:135 tcp
N/A 10.127.0.182:135 tcp
N/A 10.127.0.180:135 tcp
N/A 10.127.0.179:135 tcp
N/A 10.127.0.178:135 tcp
N/A 10.127.0.176:135 tcp
N/A 10.127.0.177:135 tcp
N/A 10.127.0.175:135 tcp
N/A 10.127.0.173:135 tcp
N/A 10.127.0.174:135 tcp
N/A 10.127.0.172:135 tcp
N/A 10.127.0.171:135 tcp
N/A 10.127.0.168:135 tcp
N/A 10.127.0.166:135 tcp
N/A 10.127.0.164:135 tcp
N/A 10.127.0.162:135 tcp
N/A 10.127.0.160:135 tcp
N/A 10.127.0.158:135 tcp
N/A 10.127.0.155:135 tcp
N/A 10.127.0.156:135 tcp
N/A 10.127.0.153:135 tcp
N/A 10.127.0.246:135 tcp
N/A 10.127.0.154:135 tcp
N/A 10.127.0.236:135 tcp
N/A 10.127.0.233:135 tcp
N/A 10.127.0.237:135 tcp
N/A 10.127.0.229:135 tcp
N/A 10.127.0.227:135 tcp
N/A 10.127.0.225:135 tcp
N/A 10.127.0.223:135 tcp
N/A 10.127.0.221:135 tcp
N/A 10.127.0.220:135 tcp
N/A 10.127.0.218:135 tcp
N/A 10.127.0.216:135 tcp
N/A 10.127.0.214:135 tcp
N/A 10.127.0.212:135 tcp
N/A 10.127.0.210:135 tcp
N/A 10.127.0.208:135 tcp
N/A 10.127.0.206:135 tcp
N/A 10.127.0.231:135 tcp
N/A 10.127.0.204:135 tcp
N/A 10.127.0.132:135 tcp
N/A 10.127.0.131:135 tcp
N/A 10.127.0.129:135 tcp
N/A 10.127.0.130:135 tcp
N/A 10.127.0.128:135 tcp
N/A 10.127.0.126:135 tcp
N/A 10.127.0.127:135 tcp
N/A 10.127.0.125:135 tcp
N/A 10.127.0.123:135 tcp
N/A 10.127.0.122:135 tcp
N/A 10.127.0.121:135 tcp
N/A 10.127.0.119:135 tcp
N/A 10.127.0.124:135 tcp
N/A 10.127.0.116:135 tcp
N/A 10.127.0.115:135 tcp
N/A 10.127.0.114:135 tcp
N/A 10.127.0.118:135 tcp
N/A 10.127.0.109:135 tcp
N/A 10.127.0.110:135 tcp
N/A 10.127.0.111:135 tcp
N/A 10.127.0.112:135 tcp
N/A 10.127.0.108:135 tcp
N/A 10.127.0.96:135 tcp
N/A 10.127.0.94:135 tcp
N/A 10.127.0.113:135 tcp
N/A 10.127.0.90:135 tcp
N/A 10.127.0.106:135 tcp
N/A 10.127.0.91:135 tcp
N/A 10.127.0.66:135 tcp
N/A 10.127.0.107:135 tcp
N/A 10.127.0.88:135 tcp
N/A 10.127.0.65:135 tcp
N/A 10.127.0.64:135 tcp
N/A 10.127.0.63:135 tcp
N/A 10.127.0.105:135 tcp
N/A 10.127.0.62:135 tcp
N/A 10.127.0.61:135 tcp
N/A 10.127.0.103:135 tcp
N/A 10.127.0.60:135 tcp
N/A 10.127.0.59:135 tcp
N/A 10.127.0.102:135 tcp
N/A 10.127.0.58:135 tcp
N/A 10.127.0.104:135 tcp
N/A 10.127.0.57:135 tcp
N/A 10.127.0.56:135 tcp
N/A 10.127.0.55:135 tcp
N/A 10.127.0.101:135 tcp
N/A 10.127.0.54:135 tcp
N/A 10.127.0.53:135 tcp
N/A 10.127.0.52:135 tcp
N/A 10.127.0.100:135 tcp
N/A 10.127.0.51:135 tcp
N/A 10.127.0.50:135 tcp
N/A 10.127.0.49:135 tcp
N/A 10.127.0.48:135 tcp
N/A 10.127.0.47:135 tcp
N/A 10.127.0.99:135 tcp
N/A 10.127.0.46:135 tcp
N/A 10.127.0.45:135 tcp
N/A 10.127.0.97:135 tcp
N/A 10.127.0.44:135 tcp
N/A 10.127.0.43:135 tcp
N/A 10.127.0.95:135 tcp
N/A 10.127.0.42:135 tcp
N/A 10.127.0.93:135 tcp
N/A 10.127.0.41:135 tcp
N/A 10.127.0.40:135 tcp
N/A 10.127.0.98:135 tcp
N/A 10.127.0.39:135 tcp
N/A 10.127.0.38:135 tcp
N/A 10.127.0.37:135 tcp
N/A 10.127.0.92:135 tcp
N/A 10.127.0.36:135 tcp
N/A 10.127.0.35:135 tcp
N/A 10.127.0.89:135 tcp
N/A 10.127.0.87:135 tcp
N/A 10.127.0.86:135 tcp
N/A 10.127.0.85:135 tcp
N/A 10.127.0.84:135 tcp
N/A 10.127.0.83:135 tcp
N/A 10.127.0.82:135 tcp
N/A 10.127.0.81:135 tcp
N/A 10.127.0.80:135 tcp
N/A 10.127.0.79:135 tcp
N/A 10.127.0.77:135 tcp
N/A 10.127.0.78:135 tcp
N/A 10.127.0.75:135 tcp
N/A 10.127.0.76:135 tcp
N/A 10.127.0.74:135 tcp
N/A 10.127.0.73:135 tcp
N/A 10.127.0.72:135 tcp
N/A 10.127.0.71:135 tcp
N/A 10.127.0.70:135 tcp
N/A 10.127.0.69:135 tcp
N/A 10.127.0.68:135 tcp
N/A 10.127.0.120:135 tcp
N/A 10.127.0.34:135 tcp
N/A 10.127.0.33:135 tcp
N/A 10.127.0.32:135 tcp
N/A 10.127.0.31:135 tcp
N/A 10.127.0.30:135 tcp
N/A 10.127.0.29:135 tcp
N/A 10.127.0.28:135 tcp
N/A 10.127.0.27:135 tcp
N/A 10.127.0.26:135 tcp
N/A 10.127.0.25:135 tcp
N/A 10.127.0.24:135 tcp
N/A 10.127.0.23:135 tcp
N/A 10.127.0.22:135 tcp
N/A 10.127.0.21:135 tcp
N/A 10.127.0.20:135 tcp
N/A 10.127.0.19:135 tcp
N/A 10.127.0.18:135 tcp
N/A 10.127.0.17:135 tcp
N/A 10.127.0.16:135 tcp
N/A 10.127.0.15:135 tcp
N/A 10.127.0.14:135 tcp
N/A 10.127.0.13:135 tcp
N/A 10.127.0.12:135 tcp
N/A 10.127.0.10:135 tcp
N/A 10.127.0.11:135 tcp
N/A 10.127.0.9:135 tcp
N/A 10.127.0.8:135 tcp
N/A 10.127.0.7:135 tcp
N/A 10.127.0.6:135 tcp
N/A 10.127.0.5:135 tcp
N/A 10.127.0.4:135 tcp
N/A 10.127.0.3:135 tcp
N/A 10.127.0.2:135 tcp
N/A 10.127.0.1:135 tcp
N/A 10.127.0.67:135 tcp
N/A 10.127.0.0:135 tcp

Files

C:\Program Files\DVD Maker\es-ES\Restore-My-Files.txt

MD5 a1fb04a0cf4c4a032a3586403ae4426b
SHA1 2f0964efa6a51f98888e2dffd09dab07571dee26
SHA256 837a3bae4d1e1e747187bb27d2a1419869132e5f8fa1cecff4c3cc81d6db5151
SHA512 86308600154496abffdc281ace920d23cc25cbd9dff3d0c6f496f7aaa596dfc002f49491eb4287d12c3a9606ad604ae2668a8b36cb3352d2329d6038003f3a01

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:22

Reported

2024-03-14 04:25

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

Signatures

Lockbit

ransomware lockbit

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (14187) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe\"" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5C54.tmp.bmp" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ja_135x40.svg.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\plugin.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h2x.png.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\SY______.PFM.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_history_18.svg.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js.lockbit C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2432 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\System32\cmd.exe
PID 2988 wrote to memory of 1132 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2988 wrote to memory of 1132 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2988 wrote to memory of 1996 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2988 wrote to memory of 1996 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2988 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2988 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2988 wrote to memory of 1300 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2988 wrote to memory of 1300 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2988 wrote to memory of 2520 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2988 wrote to memory of 2520 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2432 wrote to memory of 5704 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 2432 wrote to memory of 5704 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 2432 wrote to memory of 5704 N/A C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe C:\Windows\SysWOW64\cmd.exe
PID 5704 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5704 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5704 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5704 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 5704 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe
PID 5704 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\fsutil.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe

"C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
N/A 10.127.1.197:445 tcp
N/A 10.127.1.250:445 tcp
N/A 10.127.1.233:445 tcp
N/A 10.127.1.208:445 tcp
N/A 10.127.1.192:445 tcp
N/A 10.127.1.251:445 tcp
N/A 10.127.1.214:445 tcp
N/A 10.127.1.227:445 tcp
N/A 10.127.1.205:445 tcp
N/A 10.127.1.200:445 tcp
N/A 10.127.1.164:445 tcp
N/A 10.127.1.236:445 tcp
N/A 10.127.1.232:445 tcp
N/A 10.127.1.225:445 tcp
N/A 10.127.1.211:445 tcp
N/A 10.127.1.254:445 tcp
N/A 10.127.1.194:445 tcp
N/A 10.127.1.201:445 tcp
N/A 10.127.1.248:445 tcp
N/A 10.127.1.228:445 tcp
N/A 10.127.1.237:445 tcp
N/A 10.127.1.190:445 tcp
N/A 10.127.1.202:445 tcp
N/A 10.127.1.196:445 tcp
N/A 10.127.1.191:445 tcp
N/A 10.127.1.252:445 tcp
N/A 10.127.1.203:445 tcp
N/A 10.127.1.193:445 tcp
N/A 10.127.1.220:445 tcp
N/A 10.127.1.206:445 tcp
N/A 10.127.1.226:445 tcp
N/A 10.127.1.218:445 tcp
N/A 10.127.1.253:445 tcp
N/A 10.127.1.241:445 tcp
N/A 10.127.1.222:445 tcp
N/A 10.127.1.213:445 tcp
N/A 10.127.1.247:445 tcp
N/A 10.127.1.243:445 tcp
N/A 10.127.1.230:445 tcp
N/A 10.127.1.217:445 tcp
N/A 10.127.1.207:445 tcp
N/A 10.127.1.242:445 tcp
N/A 10.127.1.216:445 tcp
N/A 10.127.1.244:445 tcp
N/A 10.127.1.231:445 tcp
N/A 10.127.1.199:445 tcp
N/A 10.127.1.221:445 tcp
N/A 10.127.1.209:445 tcp
N/A 10.127.1.223:445 tcp
N/A 10.127.1.212:445 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
N/A 10.127.1.240:445 tcp
N/A 10.127.1.198:445 tcp
N/A 10.127.1.187:445 tcp
N/A 10.127.1.249:445 tcp
N/A 10.127.1.246:445 tcp
N/A 10.127.1.245:445 tcp
N/A 10.127.1.239:445 tcp
N/A 10.127.1.238:445 tcp
N/A 10.127.1.235:445 tcp
N/A 10.127.1.234:445 tcp
N/A 10.127.1.229:445 tcp
N/A 10.127.1.224:445 tcp
N/A 10.127.1.219:445 tcp
N/A 10.127.1.215:445 tcp
N/A 10.127.1.210:445 tcp
N/A 10.127.1.204:445 tcp
N/A 10.127.1.195:445 tcp
N/A 10.127.1.189:445 tcp
N/A 10.127.1.188:445 tcp
N/A 10.127.1.186:445 tcp
N/A 10.127.1.185:445 tcp
N/A 10.127.1.184:445 tcp
N/A 10.127.1.183:445 tcp
N/A 10.127.1.182:445 tcp
N/A 10.127.1.181:445 tcp
N/A 10.127.1.180:445 tcp
N/A 10.127.1.179:445 tcp
N/A 10.127.1.178:445 tcp
N/A 10.127.1.177:445 tcp
N/A 10.127.1.176:445 tcp
N/A 10.127.1.175:445 tcp
N/A 10.127.1.174:445 tcp
N/A 10.127.1.173:445 tcp
N/A 10.127.1.172:445 tcp
N/A 10.127.1.171:445 tcp
N/A 10.127.1.170:445 tcp
N/A 10.127.1.169:445 tcp
N/A 10.127.1.168:445 tcp
N/A 10.127.1.167:445 tcp
N/A 10.127.1.166:445 tcp
N/A 10.127.1.165:445 tcp
N/A 10.127.1.163:445 tcp
N/A 10.127.1.162:445 tcp
N/A 10.127.1.161:445 tcp
N/A 10.127.1.160:445 tcp
N/A 10.127.1.159:445 tcp
N/A 10.127.1.158:445 tcp
N/A 10.127.1.157:445 tcp
N/A 10.127.1.156:445 tcp
N/A 10.127.1.155:445 tcp
N/A 10.127.1.154:445 tcp
N/A 10.127.1.153:445 tcp
N/A 10.127.1.152:445 tcp
N/A 10.127.1.151:445 tcp
N/A 10.127.1.150:445 tcp
N/A 10.127.1.149:445 tcp
N/A 10.127.1.148:445 tcp
N/A 10.127.1.147:445 tcp
N/A 10.127.1.146:445 tcp
N/A 10.127.1.145:445 tcp
N/A 10.127.1.144:445 tcp
N/A 10.127.1.143:445 tcp
N/A 10.127.1.142:445 tcp
N/A 10.127.1.141:445 tcp
N/A 10.127.1.140:445 tcp
N/A 10.127.1.139:445 tcp
N/A 10.127.1.138:445 tcp
N/A 10.127.1.137:445 tcp
N/A 10.127.1.136:445 tcp
N/A 10.127.1.134:445 tcp
N/A 10.127.1.135:445 tcp
N/A 10.127.1.133:445 tcp
N/A 10.127.1.132:445 tcp
N/A 10.127.1.131:445 tcp
N/A 10.127.1.130:445 tcp
N/A 10.127.1.129:445 tcp
N/A 10.127.1.128:445 tcp
N/A 10.127.1.127:445 tcp
N/A 10.127.1.126:445 tcp
N/A 10.127.1.125:445 tcp
N/A 10.127.1.124:445 tcp
N/A 10.127.1.123:445 tcp
N/A 10.127.1.122:445 tcp
N/A 10.127.1.121:445 tcp
N/A 10.127.1.120:445 tcp
N/A 10.127.1.119:445 tcp
N/A 10.127.1.118:445 tcp
N/A 10.127.1.117:445 tcp
N/A 10.127.1.116:445 tcp
N/A 10.127.1.115:445 tcp
N/A 10.127.1.114:445 tcp
N/A 10.127.1.113:445 tcp
N/A 10.127.1.112:445 tcp
N/A 10.127.1.111:445 tcp
N/A 10.127.1.110:445 tcp
N/A 10.127.1.109:445 tcp
N/A 10.127.1.108:445 tcp
N/A 10.127.1.106:445 tcp
N/A 10.127.1.107:445 tcp
N/A 10.127.1.105:445 tcp
N/A 10.127.1.104:445 tcp
N/A 10.127.1.103:445 tcp
N/A 10.127.1.100:445 tcp
N/A 10.127.1.101:445 tcp
N/A 10.127.1.99:445 tcp
N/A 10.127.1.102:445 tcp
N/A 10.127.1.98:445 tcp
N/A 10.127.1.97:445 tcp
N/A 10.127.1.96:445 tcp
N/A 10.127.1.95:445 tcp
N/A 10.127.1.94:445 tcp
N/A 10.127.1.93:445 tcp
N/A 10.127.1.92:445 tcp
N/A 10.127.1.91:445 tcp
N/A 10.127.1.90:445 tcp
N/A 10.127.1.89:445 tcp
N/A 10.127.1.88:445 tcp
N/A 10.127.1.87:445 tcp
N/A 10.127.1.86:445 tcp
N/A 10.127.1.85:445 tcp
N/A 10.127.1.84:445 tcp
N/A 10.127.1.83:445 tcp
N/A 10.127.1.82:445 tcp
N/A 10.127.1.81:445 tcp
N/A 10.127.1.80:445 tcp
N/A 10.127.1.79:445 tcp
N/A 10.127.1.77:445 tcp
N/A 10.127.1.78:445 tcp
N/A 10.127.1.76:445 tcp
N/A 10.127.1.75:445 tcp
N/A 10.127.1.74:445 tcp
N/A 10.127.1.73:445 tcp
N/A 10.127.1.72:445 tcp
N/A 10.127.1.71:445 tcp
N/A 10.127.1.70:445 tcp
N/A 10.127.1.69:445 tcp
N/A 10.127.1.68:445 tcp
N/A 10.127.1.67:445 tcp
N/A 10.127.1.66:445 tcp
N/A 10.127.1.65:445 tcp
N/A 10.127.1.64:445 tcp
N/A 10.127.1.63:445 tcp
N/A 10.127.1.62:445 tcp
N/A 10.127.1.61:445 tcp
N/A 10.127.1.60:445 tcp
N/A 10.127.1.58:445 tcp
N/A 10.127.1.59:445 tcp
N/A 10.127.1.57:445 tcp
N/A 10.127.1.56:445 tcp
N/A 10.127.1.55:445 tcp
N/A 10.127.1.53:445 tcp
N/A 10.127.1.54:445 tcp
N/A 10.127.1.52:445 tcp
N/A 10.127.1.51:445 tcp
N/A 10.127.1.50:445 tcp
N/A 10.127.1.49:445 tcp
N/A 10.127.1.48:445 tcp
N/A 10.127.1.47:445 tcp
N/A 10.127.1.46:445 tcp
N/A 10.127.1.45:445 tcp
N/A 10.127.1.44:445 tcp
N/A 10.127.1.43:445 tcp
N/A 10.127.1.42:445 tcp
N/A 10.127.1.41:445 tcp
N/A 10.127.1.40:445 tcp
N/A 10.127.1.39:445 tcp
N/A 10.127.1.38:445 tcp
N/A 10.127.1.37:445 tcp
N/A 10.127.1.36:445 tcp
N/A 10.127.1.35:445 tcp
N/A 10.127.1.34:445 tcp
N/A 10.127.1.33:445 tcp
N/A 10.127.1.32:445 tcp
N/A 10.127.1.31:445 tcp
N/A 10.127.1.30:445 tcp
N/A 10.127.1.29:445 tcp
N/A 10.127.1.28:445 tcp
N/A 10.127.1.27:445 tcp
N/A 10.127.1.26:445 tcp
N/A 10.127.1.25:445 tcp
N/A 10.127.1.24:445 tcp
N/A 10.127.1.23:445 tcp
N/A 10.127.1.22:445 tcp
N/A 10.127.1.21:445 tcp
N/A 10.127.1.20:445 tcp
N/A 10.127.1.19:445 tcp
N/A 10.127.1.18:445 tcp
N/A 10.127.1.17:445 tcp
N/A 10.127.1.16:445 tcp
N/A 10.127.1.15:445 tcp
N/A 10.127.1.14:445 tcp
N/A 10.127.1.13:445 tcp
N/A 10.127.1.12:445 tcp
N/A 10.127.1.11:445 tcp
N/A 10.127.1.10:445 tcp
N/A 10.127.1.9:445 tcp
N/A 10.127.1.8:445 tcp
N/A 10.127.1.7:445 tcp
N/A 10.127.1.6:445 tcp
N/A 10.127.1.5:445 tcp
N/A 10.127.1.4:445 tcp
N/A 10.127.1.2:445 tcp
N/A 10.127.1.1:445 tcp
N/A 10.127.1.0:445 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
N/A 10.127.1.209:135 tcp
N/A 10.127.1.208:135 tcp
N/A 10.127.1.253:135 tcp
N/A 10.127.1.249:135 tcp
N/A 10.127.1.210:135 tcp
N/A 10.127.1.211:135 tcp
N/A 10.127.1.212:135 tcp
N/A 10.127.1.213:135 tcp
N/A 10.127.1.214:135 tcp
N/A 10.127.1.215:135 tcp
N/A 10.127.1.216:135 tcp
N/A 10.127.1.218:135 tcp
N/A 10.127.1.217:135 tcp
N/A 10.127.1.219:135 tcp
N/A 10.127.1.220:135 tcp
N/A 10.127.1.221:135 tcp
N/A 10.127.1.222:135 tcp
N/A 10.127.1.223:135 tcp
N/A 10.127.1.254:135 tcp
N/A 10.127.1.224:135 tcp
N/A 10.127.1.225:135 tcp
N/A 10.127.1.226:135 tcp
N/A 10.127.1.228:135 tcp
N/A 10.127.1.227:135 tcp
N/A 10.127.1.229:135 tcp
N/A 10.127.1.230:135 tcp
N/A 10.127.1.231:135 tcp
N/A 10.127.1.232:135 tcp
N/A 10.127.1.233:135 tcp
N/A 10.127.1.234:135 tcp
N/A 10.127.1.235:135 tcp
N/A 10.127.1.236:135 tcp
N/A 10.127.1.237:135 tcp
N/A 10.127.1.238:135 tcp
N/A 10.127.1.239:135 tcp
N/A 10.127.1.240:135 tcp
N/A 10.127.1.241:135 tcp
N/A 10.127.1.242:135 tcp
N/A 10.127.1.243:135 tcp
N/A 10.127.1.247:135 tcp
N/A 10.127.1.246:135 tcp
N/A 10.127.1.252:135 tcp
N/A 10.127.1.251:135 tcp
N/A 10.127.1.248:135 tcp
N/A 10.127.1.245:135 tcp
N/A 10.127.1.250:135 tcp
N/A 10.127.1.244:135 tcp
N/A 10.127.1.73:135 tcp
N/A 10.127.1.74:135 tcp
N/A 10.127.1.75:135 tcp
N/A 10.127.1.78:135 tcp
N/A 10.127.1.76:135 tcp
N/A 10.127.1.77:135 tcp
N/A 10.127.1.79:135 tcp
N/A 10.127.1.81:135 tcp
N/A 10.127.1.80:135 tcp
N/A 10.127.1.82:135 tcp
N/A 10.127.1.83:135 tcp
N/A 10.127.1.84:135 tcp
N/A 10.127.1.85:135 tcp
N/A 10.127.1.86:135 tcp
N/A 10.127.1.87:135 tcp
N/A 10.127.1.89:135 tcp
N/A 10.127.1.88:135 tcp
N/A 10.127.1.90:135 tcp
N/A 10.127.1.91:135 tcp
N/A 10.127.1.92:135 tcp
N/A 10.127.1.93:135 tcp
N/A 10.127.1.95:135 tcp
N/A 10.127.1.94:135 tcp
N/A 10.127.1.96:135 tcp
N/A 10.127.1.97:135 tcp
N/A 10.127.1.98:135 tcp
N/A 10.127.1.102:135 tcp
N/A 10.127.1.101:135 tcp
N/A 10.127.1.99:135 tcp
N/A 10.127.1.100:135 tcp
N/A 10.127.1.103:135 tcp
N/A 10.127.1.107:135 tcp
N/A 10.127.1.104:135 tcp
N/A 10.127.1.105:135 tcp
N/A 10.127.1.106:135 tcp
N/A 10.127.1.108:135 tcp
N/A 10.127.1.109:135 tcp
N/A 10.127.1.110:135 tcp
N/A 10.127.1.111:135 tcp
N/A 10.127.1.112:135 tcp
N/A 10.127.1.113:135 tcp
N/A 10.127.1.114:135 tcp
N/A 10.127.1.116:135 tcp
N/A 10.127.1.145:135 tcp
N/A 10.127.1.115:135 tcp
N/A 10.127.1.1:135 tcp
N/A 10.127.1.181:135 tcp
N/A 10.127.1.5:135 tcp
N/A 10.127.1.2:135 tcp
N/A 10.127.1.4:135 tcp
N/A 10.127.1.11:135 tcp
N/A 10.127.1.6:135 tcp
N/A 10.127.1.8:135 tcp
N/A 10.127.1.7:135 tcp
N/A 10.127.1.9:135 tcp
N/A 10.127.1.17:135 tcp
N/A 10.127.1.10:135 tcp
N/A 10.127.1.12:135 tcp
N/A 10.127.1.13:135 tcp
N/A 10.127.1.14:135 tcp
N/A 10.127.1.18:135 tcp
N/A 10.127.1.16:135 tcp
N/A 10.127.1.15:135 tcp
N/A 10.127.1.19:135 tcp
N/A 10.127.1.20:135 tcp
N/A 10.127.1.24:135 tcp
N/A 10.127.1.21:135 tcp
N/A 10.127.1.22:135 tcp
N/A 10.127.1.23:135 tcp
N/A 10.127.1.27:135 tcp
N/A 10.127.1.25:135 tcp
N/A 10.127.1.26:135 tcp
N/A 10.127.1.28:135 tcp
N/A 10.127.1.30:135 tcp
N/A 10.127.1.34:135 tcp
N/A 10.127.1.29:135 tcp
N/A 10.127.1.31:135 tcp
N/A 10.127.1.32:135 tcp
N/A 10.127.1.33:135 tcp
N/A 10.127.1.41:135 tcp
N/A 10.127.1.35:135 tcp
N/A 10.127.1.36:135 tcp
N/A 10.127.1.44:135 tcp
N/A 10.127.1.38:135 tcp
N/A 10.127.1.37:135 tcp
N/A 10.127.1.39:135 tcp
N/A 10.127.1.40:135 tcp
N/A 10.127.1.42:135 tcp
N/A 10.127.1.49:135 tcp
N/A 10.127.1.43:135 tcp
N/A 10.127.1.45:135 tcp
N/A 10.127.1.46:135 tcp
N/A 10.127.1.47:135 tcp
N/A 10.127.1.48:135 tcp
N/A 10.127.1.58:135 tcp
N/A 10.127.1.51:135 tcp
N/A 10.127.1.50:135 tcp
N/A 10.127.1.54:135 tcp
N/A 10.127.1.52:135 tcp
N/A 10.127.1.53:135 tcp
N/A 10.127.1.56:135 tcp
N/A 10.127.1.57:135 tcp
N/A 10.127.1.55:135 tcp
N/A 10.127.1.59:135 tcp
N/A 10.127.1.60:135 tcp
N/A 10.127.1.66:135 tcp
N/A 10.127.1.61:135 tcp
N/A 10.127.1.64:135 tcp
N/A 10.127.1.62:135 tcp
N/A 10.127.1.63:135 tcp
N/A 10.127.1.71:135 tcp
N/A 10.127.1.68:135 tcp
N/A 10.127.1.65:135 tcp
N/A 10.127.1.69:135 tcp
N/A 10.127.1.67:135 tcp
N/A 10.127.1.203:135 tcp
N/A 10.127.1.70:135 tcp
N/A 10.127.1.72:135 tcp
N/A 10.127.1.207:135 tcp
N/A 10.127.1.205:135 tcp
N/A 10.127.1.200:135 tcp
N/A 10.127.1.201:135 tcp
N/A 10.127.1.206:135 tcp
N/A 10.127.1.202:135 tcp
N/A 10.127.1.204:135 tcp
N/A 10.127.1.199:135 tcp
N/A 10.127.1.198:135 tcp
N/A 10.127.1.192:135 tcp
N/A 10.127.1.197:135 tcp
N/A 10.127.1.196:135 tcp
N/A 10.127.1.194:135 tcp
N/A 10.127.1.195:135 tcp
N/A 10.127.1.193:135 tcp
N/A 10.127.1.187:135 tcp
N/A 10.127.1.191:135 tcp
N/A 10.127.1.189:135 tcp
N/A 10.127.1.190:135 tcp
N/A 10.127.1.188:135 tcp
N/A 10.127.1.182:135 tcp
N/A 10.127.1.186:135 tcp
N/A 10.127.1.185:135 tcp
N/A 10.127.1.184:135 tcp
N/A 10.127.1.183:135 tcp
N/A 10.127.1.176:135 tcp
N/A 10.127.1.179:135 tcp
N/A 10.127.1.180:135 tcp
N/A 10.127.1.178:135 tcp
N/A 10.127.1.172:135 tcp
N/A 10.127.1.175:135 tcp
N/A 10.127.1.177:135 tcp
N/A 10.127.1.173:135 tcp
N/A 10.127.1.174:135 tcp
N/A 10.127.1.166:135 tcp
N/A 10.127.1.171:135 tcp
N/A 10.127.1.170:135 tcp
N/A 10.127.1.169:135 tcp
N/A 10.127.1.167:135 tcp
N/A 10.127.1.168:135 tcp
N/A 10.127.1.162:135 tcp
N/A 10.127.1.163:135 tcp
N/A 10.127.1.165:135 tcp
N/A 10.127.1.159:135 tcp
N/A 10.127.1.164:135 tcp
N/A 10.127.1.161:135 tcp
N/A 10.127.1.157:135 tcp
N/A 10.127.1.160:135 tcp
N/A 10.127.1.156:135 tcp
N/A 10.127.1.158:135 tcp
N/A 10.127.1.155:135 tcp
N/A 10.127.1.154:135 tcp
N/A 10.127.1.152:135 tcp
N/A 10.127.1.153:135 tcp
N/A 10.127.1.150:135 tcp
N/A 10.127.1.149:135 tcp
N/A 10.127.1.151:135 tcp
N/A 10.127.1.148:135 tcp
N/A 10.127.1.147:135 tcp
N/A 10.127.1.146:135 tcp
N/A 10.127.1.141:135 tcp
N/A 10.127.1.143:135 tcp
N/A 10.127.1.144:135 tcp
N/A 10.127.1.142:135 tcp
N/A 10.127.1.137:135 tcp
N/A 10.127.1.140:135 tcp
N/A 10.127.1.139:135 tcp
N/A 10.127.1.138:135 tcp
N/A 10.127.1.136:135 tcp
N/A 10.127.1.132:135 tcp
N/A 10.127.1.134:135 tcp
N/A 10.127.1.133:135 tcp
N/A 10.127.1.135:135 tcp
N/A 10.127.1.122:135 tcp
N/A 10.127.1.130:135 tcp
N/A 10.127.1.131:135 tcp
N/A 10.127.1.128:135 tcp
N/A 10.127.1.129:135 tcp
N/A 10.127.1.124:135 tcp
N/A 10.127.1.127:135 tcp
N/A 10.127.1.125:135 tcp
N/A 10.127.1.126:135 tcp
N/A 10.127.1.123:135 tcp
N/A 10.127.1.119:135 tcp
N/A 10.127.1.121:135 tcp
N/A 10.127.1.120:135 tcp
N/A 10.127.1.118:135 tcp
N/A 10.127.1.0:135 tcp
N/A 10.127.1.117:135 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

C:\Program Files\dotnet\Restore-My-Files.txt

MD5 ccca3fd2a8d2c798c07ddb647f058c1a
SHA1 4f956dc8eb6c3643153c6caf44d2902f96fed777
SHA256 21752ec47758523cd5d37ad0e9793f2e13d33c6cc6eb2e516aebcea97d5f3e42
SHA512 a73ea7fc47d2e04b892277c6c4a4b4d62f1342559b1cadd482525c0537b2a9188cc515db8dd05bff2f546f7922cb336d5d58bba95bc957a941083bccf011f460