Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-03-2021 16:46
Static task
static1
Behavioral task
behavioral1
Sample
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
Resource
win10v20201028
General
-
Target
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
-
Size
164KB
-
MD5
890a58f200dfff23165df9e1b088e58f
-
SHA1
74e3d82f7ee81109e150dc41112cf95b3a4b5307
-
SHA256
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
-
SHA512
2ee3636833cd9b02f5e311401817b15514845d4c12c1416d7e345845f8084775bf8c5f8f32822066b75a6b627a93138a0b27deb99c8bbb1f8d640132a2d8de0d
Malware Config
Extracted
C:\oh13bzq7o4-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/505EC86632631280
http://decryptor.top/505EC86632631280
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File renamed C:\Users\Admin\Pictures\SaveSubmit.crw => \??\c:\users\admin\pictures\SaveSubmit.crw.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\AddUnpublish.raw => \??\c:\users\admin\pictures\AddUnpublish.raw.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\CompleteUse.tif => \??\c:\users\admin\pictures\CompleteUse.tif.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\CompressShow.tif => \??\c:\users\admin\pictures\CompressShow.tif.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\HideRegister.crw => \??\c:\users\admin\pictures\HideRegister.crw.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\RequestOut.crw => \??\c:\users\admin\pictures\RequestOut.crw.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\SearchWait.raw => \??\c:\users\admin\pictures\SearchWait.raw.oh13bzq7o4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File opened (read-only) \??\A: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\H: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\I: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\P: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Q: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\R: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\X: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\F: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\K: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\N: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\U: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\D: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\B: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\E: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\O: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\S: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\W: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Z: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\G: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\J: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\L: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\M: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\T: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\V: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Y: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jky22v.bmp" 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Drops file in Program Files directory 27 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File opened for modification \??\c:\program files\SendWatch.csv 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\SetOptimize.m4v 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ShowWatch.shtml 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\EditSearch.wvx 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files (x86)\d60dff40.lock 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\HideDebug.mov 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\PingRemove.wmv 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\SyncWatch.raw 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\WatchStop.M2T 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files\d60dff40.lock 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\InstallOptimize.cr2 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\CompareProtect.wdp 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\AssertWrite.tmp 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\InvokeSend.kix 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\MountResize.dxf 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\SelectShow.emf 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files\oh13bzq7o4-readme.txt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\RedoRegister.m1v 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\SetRename.mp4v 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ImportSend.mp4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\PingMerge.mpe 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\EnterCheckpoint.pps 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\MergeUndo.mhtml 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\TraceMerge.wm 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files (x86)\oh13bzq7o4-readme.txt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\MergeResolve.tmp 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\UndoRestart.WTV 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Drops file in Windows directory 64 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_25531ff4d974faf9_bamsettingsclient.dll_db7ec840 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_th-th_f86cf2fb5a7af7cf_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_vgasyse.fon_af851b69 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1_vdsutil.dll_f2ef43cf 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_nb-no_82c9d6ba4bb6c1ef_memtest.efi.mui_71e15c22 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480_bootmgr.efi_da0f14a8 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.15063.0_none_dff11f9f2a050a3f_ntdsapi.dll_23e20303 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.15063.0_en-us_6f2b6a7eee701612_kmddsp.tsp.mui_80ddeedb 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.15063.0_none_8375fc1900429a0a.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ar-sa_c50cf4a0af973ef3_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_hid-user.resources_31bf3856ad364e35_10.0.15063.0_en-us_76b6693524012765_hidserv.dll.mui_561adfc8 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga861.fon_0763ad86 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pt-br_59d1ffcc04432003.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_74d5f5c7b3aae50f_dsreg.dll.mui_5d9efc7e 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.15063.0_en-us_31d27467b2b5145e.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_he-il_0d3c12cce5f4147b_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsi.psd1_8e91985d 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-m..lecore-ras-base-vpn_31bf3856ad364e35_10.0.15063.0_none_ac03f6041976ffc4_rasapi32.dll_5418d87b 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.15063.0_none_b18bca773d8e9dae.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_b8c0e267f83754d0.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.15063.0_none_2aad78202bd046dc_power.settings.processor.ppkg_04839598 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_en-us_a2d137bdfba7a703_firewallapi.dll.mui_43c7a05b 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_tr-tr_e65f15b7ce792a57.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.15063.0_en-us_af1aa8cbf99dbd7d.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_e5b46fa55359ca49.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_en-us_1b9eda7aacdf6c87_keyiso.dll.mui_4bbf12ff 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_156aa3a91701e260.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704_applockercsp.dll_771a831b 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ru-ru_d90ce5ca72c0a37e_bootmgr.efi.mui_be5d0075 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-volsnap_31bf3856ad364e35_10.0.15063.0_none_703dcec1da3ef92f.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.15063.0_none_4921bb9511ea287a_secrecs.inf_bf424507 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_6dc3296afdb08731.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.15063.0_none_67af460eee1c40c7_netio.sys_a06e75d0 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_7f2aa019e80ba70a_userdeviceregistration.ngc.dll.mui_d2c6ca95 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_en-us_6a6c9bb281748302_applockercsp.dll.mui_d2a0df70 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_31d84559df5d6bca_memtest.exe.mui_77b8cbcc 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.15063.0_none_d59c739232043625_ntasn1.dll_a6567dcf 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_d3bf5352148cac82_bootmgr.exe.mui_c434701f 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_c99395587677579e_wintypes.dll.mui_36d5f25a 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_b1f083c49b33a6e0.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_el-gr_8f9125b021f304a0_bootmgfw.efi.mui_a6e78cfa 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_en-gb_886312f82692f412_bootmgfw.efi.mui_a6e78cfa 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.15063.0_none_af2668ccc37b0411_kernel32.dll_ef9eca7e 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_7817d3bd3211492c.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_66e3922ab91bb38c_memtest.efi.mui_71e15c22 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_5337c09478c69707.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ru-ru_6fbaaffc5d91072d.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ne-client-overrides_31bf3856ad364e35_10.0.15063.0_none_43849a6a5b3b562b_power.energyestimationengine.cpu.ppkg_d2e30320 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-br_2835cecc79400925_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_fr-ca_c192b575045d79b3_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-br_6fe305a38dbc322b.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gpuenergydriver_31bf3856ad364e35_10.0.15063.0_none_5f8d670fc6da540a.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.15063.0_none_7d3d04174acaa727_shell32.dll_0d29dca9 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nl-nl_dfa589a69594078d.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_uk-ua_50a2c75f3aa739c5.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_en-us_c3c95b73e48b1ae8_iscsicli.exe.mui_64c0a23c 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e5db677400777894_winmgmtr.dll.mui_741bfb68 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.15063.0_none_20ead682ac8d69e0.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5f76fb5d5934b9cf.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.15063.0_none_c729b8d286af64eb_msvcp_win.dll_48149df4 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sr-..-rs_2ed8755544e099be_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_zh-cn_cdcd398d082a0e9e_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.15063.0_none_c6c4eadade764d0d.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_091ece90de4588c6_msvcp110_win.dll_397cf9b6 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 992 vssadmin.exe -
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exepid process 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1484 vssvc.exe Token: SeRestorePrivilege 1484 vssvc.exe Token: SeAuditPrivilege 1484 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.execmd.exedescription pid process target process PID 1276 wrote to memory of 2668 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe PID 1276 wrote to memory of 2668 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe PID 1276 wrote to memory of 2668 1276 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe PID 2668 wrote to memory of 992 2668 cmd.exe vssadmin.exe PID 2668 wrote to memory of 992 2668 cmd.exe vssadmin.exe PID 2668 wrote to memory of 992 2668 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe"C:\Users\Admin\AppData\Local\Temp\5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:992
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-8-0x0000000000000000-mapping.dmp
-
memory/1276-2-0x0000000000D90000-0x0000000000D9A000-memory.dmpFilesize
40KB
-
memory/1276-3-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/1276-4-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/1276-5-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/1276-6-0x0000000002620000-0x0000000002626000-memory.dmpFilesize
24KB
-
memory/2668-7-0x0000000000000000-mapping.dmp