lockbit | eb1244dffe50caf97e072c606d10f08f2ba6b712adba772cf62c6b9708f1d2f6

Resubmissions

29/12/2024, 13:04 UTC

241229-qay7easkhp 10

29/12/2024, 04:36 UTC

241229-e8kwwsspht 10

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 04:36 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
Size

959KB
MD5

aae021c0f8b3d4d319235d1025c1f35d
SHA1

c0893afb208b4ae591e8bf130b5c2077771e7706
SHA256

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037
SHA512

f3fcf2d08fca0a679e08de4912dd4cca5f2aa4af3d500702568c7e6bb53680bfd7dac991126a8cf47faf0d2f8f067a50d123568b5c2a85811e347a0da62855df
SSDEEP

24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdGF:Ujrc2So1Ff+B3k796o

Score

10^/10

lockbit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: C9429E1B932B36E8933A61D9B7B1BDAD

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1492	bcdedit.exe
2912	bcdedit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\{EE42941B-2B2B-36A4-1789-17C195342C84} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe\""	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\C9429E.ico	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\program files\java\jdk1.7.0_80\db\bin\ij	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\zi\pacific\palau	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\es-es\css\settings.css	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\images\btn_search_over_bidi.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File created	C:\program files (x86)\adobe\reader 9.0\reader\plug_ins\acroform\pmp\Restore-My-Files.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\tab_on.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0301432.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so02439_.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\bin\server\classes.jsa	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\jfxrt.jar	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\fd01657_.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0196164.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File created	C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\Restore-My-Files.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\pubwiz\dgboxes.dpv	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\license	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0151061.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0199429.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\pssketsm.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\bullets\bd14869_.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File created	C:\program files\java\jre7\lib\zi\etc\Restore-My-Files.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\quickstyles\default.dotx	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\dvd maker\en-us\dvdmaker.exe.mui	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\meta-inf\eclipse_.sf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\fr-fr\js\weather.js	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\tab_on.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\templates\1033\blacktienewsletter.dotx	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_box_top.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\videolan\vlc\lua\http\requests\status.xml	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_corner_top_left.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\an01044_.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\ja-jp\css\settings.css	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\btn_search_down.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\meta-inf\eclipse_.rsa	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\zi\asia\sakhalin	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0309902.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\zi\australia\lindeman	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\images\docked_black_few-showers.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\pubwiz\dgzip.dpv	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\weather.gadget\es-es\js\settings.js	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_cn.jar	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\zi\africa\tripoli	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jre7\lib\zi\europe\volgograd	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\setlang.hxs	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\indiana\winamac	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\dd01163_.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\autoshap\bd18250_.wmf	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\bullets\bd21337_.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\forms\1033\contact.cfg	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\windows sidebar\gadgets\clock.gadget\images\diner_s.png	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\lines\bd15185_.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir00.gif	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File created	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\Restore-My-Files.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\antigua	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\europe\kaliningrad	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File created	C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\config\modules\Restore-My-Files.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
File opened for modification	C:\program files\microsoft office\office14\1033\mso example intl setup file b.txt	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	2444	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2580	vssadmin.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\Registry\Machine\Software\Classes\.lockbit	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
Key created	\Registry\Machine\Software\Classes\.lockbit\DefaultIcon	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\C9429E.ico"	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
Token: SeDebugPrivilege	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1384	WMIC.exe
Token: SeSecurityPrivilege	1384	WMIC.exe
Token: SeTakeOwnershipPrivilege	1384	WMIC.exe
Token: SeLoadDriverPrivilege	1384	WMIC.exe
Token: SeSystemProfilePrivilege	1384	WMIC.exe
Token: SeSystemtimePrivilege	1384	WMIC.exe
Token: SeProfSingleProcessPrivilege	1384	WMIC.exe
Token: SeIncBasePriorityPrivilege	1384	WMIC.exe
Token: SeCreatePagefilePrivilege	1384	WMIC.exe
Token: SeBackupPrivilege	1384	WMIC.exe
Token: SeRestorePrivilege	1384	WMIC.exe
Token: SeShutdownPrivilege	1384	WMIC.exe
Token: SeDebugPrivilege	1384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1384	WMIC.exe
Token: SeRemoteShutdownPrivilege	1384	WMIC.exe
Token: SeUndockPrivilege	1384	WMIC.exe
Token: SeManageVolumePrivilege	1384	WMIC.exe
Token: 33	1384	WMIC.exe
Token: 34	1384	WMIC.exe
Token: 35	1384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1384	WMIC.exe
Token: SeSecurityPrivilege	1384	WMIC.exe
Token: SeTakeOwnershipPrivilege	1384	WMIC.exe
Token: SeLoadDriverPrivilege	1384	WMIC.exe
Token: SeSystemProfilePrivilege	1384	WMIC.exe
Token: SeSystemtimePrivilege	1384	WMIC.exe
Token: SeProfSingleProcessPrivilege	1384	WMIC.exe
Token: SeIncBasePriorityPrivilege	1384	WMIC.exe
Token: SeCreatePagefilePrivilege	1384	WMIC.exe
Token: SeBackupPrivilege	1384	WMIC.exe
Token: SeRestorePrivilege	1384	WMIC.exe
Token: SeShutdownPrivilege	1384	WMIC.exe
Token: SeDebugPrivilege	1384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1384	WMIC.exe
Token: SeRemoteShutdownPrivilege	1384	WMIC.exe
Token: SeUndockPrivilege	1384	WMIC.exe
Token: SeManageVolumePrivilege	1384	WMIC.exe
Token: 33	1384	WMIC.exe
Token: 34	1384	WMIC.exe
Token: 35	1384	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3008	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	30
PID 2444 wrote to memory of 3008	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	30
PID 2444 wrote to memory of 3008	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	30
PID 2444 wrote to memory of 3008	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	30
PID 3008 wrote to memory of 2580	3008	cmd.exe	33
PID 3008 wrote to memory of 2580	3008	cmd.exe	33
PID 3008 wrote to memory of 2580	3008	cmd.exe	33
PID 3008 wrote to memory of 1384	3008	cmd.exe	36
PID 3008 wrote to memory of 1384	3008	cmd.exe	36
PID 3008 wrote to memory of 1384	3008	cmd.exe	36
PID 3008 wrote to memory of 1492	3008	cmd.exe	38
PID 3008 wrote to memory of 1492	3008	cmd.exe	38
PID 3008 wrote to memory of 1492	3008	cmd.exe	38
PID 3008 wrote to memory of 2912	3008	cmd.exe	39
PID 3008 wrote to memory of 2912	3008	cmd.exe	39
PID 3008 wrote to memory of 2912	3008	cmd.exe	39
PID 2444 wrote to memory of 1568	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	42
PID 2444 wrote to memory of 1568	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	42
PID 2444 wrote to memory of 1568	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	42
PID 2444 wrote to memory of 1568	2444	48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe	42

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
"C:\Users\Admin\AppData\Local\Temp\48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2580
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1492
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1136
  2⤵
  - Program crash
  PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604

Network

No results found

10.127.0.1:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

104 B
2
10.127.0.1:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

104 B
2
10.127.0.0:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.0:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.2:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.2:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.3:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.3:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.4:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.4:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.5:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.5:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.6:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.6:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.7:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.7:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.8:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.8:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.9:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.9:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.10:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.10:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.11:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.11:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.12:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.12:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.13:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.13:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.14:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.14:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.15:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.15:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.16:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.16:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.17:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.17:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.18:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.18:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.19:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.19:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.20:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.20:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.21:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.21:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.22:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.22:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.23:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.23:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.24:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.24:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.25:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.25:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.26:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.26:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.27:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.27:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.28:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.28:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.29:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.29:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.30:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.30:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.31:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.31:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.32:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.32:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.33:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.33:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.34:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.34:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.35:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.35:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.36:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.36:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.37:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.37:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.38:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.38:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.39:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.39:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.40:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.40:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.41:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.41:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.42:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.42:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.43:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.43:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.44:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.44:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.45:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.45:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.46:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.46:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.47:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.47:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.48:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.48:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.49:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.49:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.50:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.50:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.51:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.51:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.52:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.52:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.53:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.53:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.54:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.54:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.55:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.55:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.56:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.56:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.57:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.57:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.58:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.58:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.59:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.59:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.60:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.60:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.61:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.61:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.62:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.62:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.63:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.63:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.64:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.64:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.65:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.65:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.66:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.66:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.67:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.67:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.68:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.68:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.69:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.69:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.70:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.70:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.71:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.71:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.72:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.72:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.73:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.73:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.74:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.74:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.75:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.75:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.76:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.76:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.77:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.77:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.78:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.78:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.79:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.79:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.80:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.80:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.81:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.81:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.82:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.82:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.83:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.83:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.84:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.84:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.85:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.85:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.86:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.86:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.87:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.87:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.88:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.88:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.89:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.89:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.90:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.90:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.91:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.91:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.92:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.92:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.93:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.93:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.94:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.94:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.95:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.95:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.96:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.96:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.97:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.97:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.98:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.98:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.99:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.99:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.100:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.100:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.101:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.101:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.102:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.102:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.103:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.103:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.104:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.104:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.105:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.105:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.106:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.106:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.107:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.107:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.108:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.108:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.109:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.109:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.110:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.110:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.111:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.111:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.112:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.112:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.113:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.113:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.114:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.114:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.115:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.115:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.116:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.116:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.117:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.117:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.118:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.118:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.119:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.119:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.120:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.120:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.121:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.121:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.122:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.122:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.123:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.123:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.124:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.124:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.125:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.125:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.126:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.126:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.127:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.127:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.128:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.128:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.129:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.129:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.130:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.130:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.131:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.131:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.132:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.132:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.133:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.133:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.134:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.134:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.135:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.135:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.136:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.136:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.137:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.137:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.138:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.138:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.139:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.139:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.140:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.140:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.141:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.141:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.142:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.142:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.143:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.143:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.144:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.144:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.145:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.145:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.146:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.146:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.147:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.147:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.148:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.148:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.149:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.149:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.150:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.150:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.151:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.151:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.152:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.152:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.153:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.153:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.154:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.154:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.155:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.155:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.156:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.156:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.157:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.157:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.158:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.158:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.159:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.159:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.160:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.160:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.161:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.161:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.162:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.162:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.163:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.163:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.164:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.164:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.165:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.165:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.166:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.166:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.167:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.167:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.168:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.168:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.169:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.169:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.170:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.170:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.171:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.171:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.172:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.172:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.173:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.173:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.174:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.174:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.175:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.175:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.176:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.176:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.177:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.177:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.178:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.178:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.179:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.179:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.180:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.180:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.181:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.181:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.182:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.182:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.183:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.183:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.184:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.184:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.185:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.185:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.186:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.186:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.187:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.187:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.188:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.188:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.189:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.189:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.190:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.190:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.191:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.191:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.192:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.192:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.193:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.193:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.194:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.194:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.195:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.195:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.196:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.196:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.197:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.197:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.198:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.198:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.199:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.199:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.200:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.200:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.201:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.201:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.202:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.202:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.203:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.203:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.204:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.204:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.205:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.205:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.206:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.206:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.207:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.207:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.208:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.208:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.209:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.209:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.210:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.210:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.211:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.211:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.212:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.212:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.213:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.213:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.214:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.214:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.215:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.215:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.216:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.216:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.217:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.217:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.218:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.218:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.219:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.219:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.220:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.220:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.221:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.221:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.222:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.222:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.223:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.223:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.224:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.224:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.225:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.225:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.226:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.226:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.227:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.227:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.228:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.228:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.229:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.229:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.230:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.230:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.231:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.231:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.232:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.232:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.233:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.233:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.234:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.234:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.235:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.235:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.236:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.236:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.237:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.237:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.238:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.238:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.239:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.239:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.240:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.240:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.241:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.241:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.242:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.242:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.243:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.243:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.244:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.244:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.245:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.245:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.246:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.246:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.247:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.247:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.248:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.248:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.249:135

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe
10.127.0.249:445

48116c6b904486d50de874c9afe866a2e4f66c1fdbef60ccdae2b440ebe64037.exe

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Filesize
512B

MD5
a9865ed2311151ae87b7bca9015a5035

SHA1
5d0087fe9cb4ca38fe3dd53fb6edb46a3d39ef66

SHA256
437d9a94ef490cedc8cb7c86a0525e529b5d41d52fef3b8e0eaad31e37d44de1

SHA512
65e4e244e61a1955cb80b6e42cfa1cdf813217747e5c21c16e491a32a4af310e48e95d89f20aba8ebbe9081207f77aba9bd27812192c3732f2c315c88e64e0c1

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.