Malware Analysis Report

2024-11-13 14:58

Sample ID 240314-ezwxssad3w
Target de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48
SHA256 de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48
Tags
ransomware spyware stealer lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48

Threat Level: Known bad

The file de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48 was found to be: Known bad.

Malicious Activity Summary

ransomware spyware stealer lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (594) files with added filename extension

Renames multiple (307) files with added filename extension

Executes dropped EXE

Deletes itself

Reads user/profile data of web browsers

Loads dropped DLL

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:23

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:23

Reported

2024-03-14 04:25

Platform

win7-20240221-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe"

Signatures

Renames multiple (307) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\AD6F.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\AD6F.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\AD6F.tmp N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe

"C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\ProgramData\AD6F.tmp

"C:\ProgramData\AD6F.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AD6F.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x154

Network

N/A

Files

memory/2940-0-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini

MD5 f8f03b3e7841cb871368eb65a2e67e22
SHA1 ea73a83c8853b1af3c056ccd9effc3aa65cd29eb
SHA256 a58771bd78b7632937020d659e05a6f2df7e07f0fc04521e53696bca42a4b922
SHA512 3f8105bc6bbe748e27c0d8556773fb210a1bac19d15379b0367567525410492a02f4422f7fe1515e1e501f504d66ba861fece8fdf73c76dbe1543fb57dd1f6f9

C:\Users\Admin\JoJLDTofE.README.txt

MD5 09e1680a7b7b2f24a426229f865b28df
SHA1 b11cf264858b208cfa68a0cd954d7809019ebdca
SHA256 64978f92ee086ffb0ccc65e85a1bfac035fc29d66d952c7b19fd13572622cfe9
SHA512 9f7e605b257a33a3362103cc00338f4a80ab9b6b210e7bc49865f691534d66b6c89f66ed015f5dc1ff87278cabda37074d11951f790b1e11d5ecd036ab80e7d4

F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\OOOOOOOOOOO

MD5 0074327ffbaf4ddf6bad1241638d9428
SHA1 18346f794860e365a5a95c5c302a1bcce18641a1
SHA256 7102a09b196917849f321fd0666ee48314f2f3593e99551a20db63fb55ab2b9a
SHA512 041f976fe611142828e5830a66b31e77007780f7c5b6dd3561e158dfc3c78a46880033d803c2c21c7be439d430be561ebb0d5a1b08b8f72b13c08f199c032bf2

\ProgramData\AD6F.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1180-822-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1180-824-0x0000000000250000-0x0000000000290000-memory.dmp

memory/1180-827-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1180-828-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 a6076504313fd806f1a9728f78ee4375
SHA1 bad537002a1a0605fbed47de38df7205e21b7fbd
SHA256 101a637facbedc8f7d6470751ba2d2dcf2cfdc843b37fca6a4ac57afcc295147
SHA512 09c07b3302f0e30ceeb1645dbfa124f963c775bb59685ae4fae2f3854427c9ce3377a67b56a83926bd6d0aea806e40f161690b0df2e2117eb8f795b9ff6338df

memory/1180-854-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1180-855-0x000000007EF60000-0x000000007EF61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:23

Reported

2024-03-14 04:26

Platform

win10v2004-20240226-en

Max time kernel

166s

Max time network

176s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe"

Signatures

Renames multiple (594) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe

"C:\Users\Admin\AppData\Local\Temp\de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3924 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 96.17.178.176:80 tcp

Files

memory/956-0-0x0000000002940000-0x0000000002950000-memory.dmp

memory/956-1-0x0000000002940000-0x0000000002950000-memory.dmp

memory/956-2-0x0000000002940000-0x0000000002950000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1904519900-954640453-4250331663-1000\IIIIIIIIIII

MD5 80bf5be53d11f41bdd8014a4060a4be7
SHA1 99d13940c2a54dc297963c267a30a90ad528b812
SHA256 15cc92498bbcea45820035923451203e6787c5773d1e249bf9ec135aa50ad26d
SHA512 bf5d6cd26cc10471ed8f311bb6a0783f6dd0edf549a5e1c5a0778185de5330d7060e97f66ac00190f03bfca4f5dff8624ab9c46ed300defb3d0635e08204e1f7

C:\JoJLDTofE.README.txt

MD5 09e1680a7b7b2f24a426229f865b28df
SHA1 b11cf264858b208cfa68a0cd954d7809019ebdca
SHA256 64978f92ee086ffb0ccc65e85a1bfac035fc29d66d952c7b19fd13572622cfe9
SHA512 9f7e605b257a33a3362103cc00338f4a80ab9b6b210e7bc49865f691534d66b6c89f66ed015f5dc1ff87278cabda37074d11951f790b1e11d5ecd036ab80e7d4

F:\$RECYCLE.BIN\S-1-5-21-1904519900-954640453-4250331663-1000\DDDDDDDDDDD

MD5 33a660f9ad1ec0f453a33a1663aed65d
SHA1 9743361686e1aa401ca1e6a573b1c78061815ea1
SHA256 5f05a2177adaa239995391103c660a86b44707f4292a3291fdc3e54e1b1b5397
SHA512 88ff33f9f2c27b41a35b5afabdbfc5c89247cfe2924ea834524a479aacc54131bc882a4e3bd1abcde6eecf54989ca9b28649f212aa97f6d956aadd793a4c7a48

memory/956-2745-0x0000000002940000-0x0000000002950000-memory.dmp

memory/956-2746-0x0000000002940000-0x0000000002950000-memory.dmp

memory/956-2747-0x0000000002940000-0x0000000002950000-memory.dmp