Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 12:42
Static task
static1
Behavioral task
behavioral1
Sample
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe
Resource
win10v20210410
General
-
Target
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe
-
Size
161KB
-
MD5
98164254301c7670ce8466d7f488608d
-
SHA1
ce0f5b0b1cf7d5c63848b4c7af1cf4de895e672d
-
SHA256
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6
-
SHA512
39fbf256eae87be00ea51f59ef259f541f53c607cb67479cf3068cf3aeb9119fbf86555027c1e4c895458693fd1b990990088a7d35c1c9f5ffdb7a74a6197621
Malware Config
Extracted
C:\ltl88-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2A9AD7F31BCC9C8F
http://decryptor.top/2A9AD7F31BCC9C8F
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
suricata: ET MALWARE Known Sinkhole Response Header
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\EnterRegister.tiff 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\ConfirmUndo.tiff => \??\c:\users\admin\pictures\ConfirmUndo.tiff.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\EnterRegister.tiff => \??\c:\users\admin\pictures\EnterRegister.tiff.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\LimitRead.png => \??\c:\users\admin\pictures\LimitRead.png.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\ReadMeasure.tif => \??\c:\users\admin\pictures\ReadMeasure.tif.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\ReceiveTest.tif => \??\c:\users\admin\pictures\ReceiveTest.tif.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\SuspendInstall.crw => \??\c:\users\admin\pictures\SuspendInstall.crw.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\users\admin\pictures\CompareSend.tiff 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\users\admin\pictures\ConfirmUndo.tiff 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\CompareCheckpoint.tif => \??\c:\users\admin\pictures\CompareCheckpoint.tif.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\CompareSend.tiff => \??\c:\users\admin\pictures\CompareSend.tiff.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File renamed C:\Users\Admin\Pictures\NewUnregister.tif => \??\c:\users\admin\pictures\NewUnregister.tif.ltl88 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process File opened (read-only) \??\M: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\V: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\W: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\X: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\G: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\J: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\I: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\O: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\R: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\T: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\D: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\A: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\B: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\Z: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\N: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\U: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\H: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\K: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\L: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\P: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\Q: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\S: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\E: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\F: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened (read-only) \??\Y: 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\o1371u.bmp" 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Drops file in Program Files directory 31 IoCs
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process File opened for modification \??\c:\program files\ConvertSplit.pdf 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\ExpandStep.aif 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\FindResize.nfo 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File created \??\c:\program files\ltl88-readme.txt 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\MoveUnprotect.mpp 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\WatchSave.pps 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\ConvertFromWait.zip 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\FormatConvert.vssm 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\SetFind.gif 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\SetRepair.TTS 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\TestNew.mpg 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\TraceRegister.mp2v 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\CompressResume.xls 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\InstallUpdate.ADTS 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\SetAdd.dib 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File created \??\c:\program files (x86)\ltl88-readme.txt 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\ConvertResize.tmp 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\GetEdit.tif 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\SavePop.snd 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\UnprotectConfirm.svg 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\CheckpointResolve.txt 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\HideSuspend.ttc 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\StopSend.ADTS 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\HideAssert.MTS 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\FindConvertFrom.svgz 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\ReadLimit.wma 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\RemoveShow.easmx 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\RevokeSplit.7z 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\SearchFormat.pptx 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\StepProtect.emf 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification \??\c:\program files\CompleteSet.tiff 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pt-br_c999671e308ecd5c.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_2655bd395ad3f038.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-mpr_31bf3856ad364e35_10.0.15063.0_none_c93e4cfdc520cd04.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_1ef4411ab33dfe81_pppmenu.scp_74b84d65 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon-sysntfy_31bf3856ad364e35_10.0.15063.0_none_6686cc5b4881feb6_sysntfy.dll_6c0b60ae 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-directcomposition_31bf3856ad364e35_10.0.15063.0_none_b8dd2546aef29fc8.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-pdc-mw_31bf3856ad364e35_10.0.15063.0_none_33e5ebd3a5fb8454.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_sv-se_b76ddd15406997ba_memtest.exe.mui_77b8cbcc 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-profapi_31bf3856ad364e35_10.0.15063.0_none_19b189889e364052.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_el-gr_fbbc855ddf690df7_msimsg.dll.mui_72e8994f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.15063.0_none_ea45c9f15e65cc3a_w32topl.dll_1a0f388b 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lv-lv_72e9ed34808e8431_msimsg.dll.mui_72e8994f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_fr-ca_2ae4eb43198d1604_bootmgfw.efi.mui_a6e78cfa 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.15063.0_none_2aad78202bd046dc_power.settings.pciexpress.ppkg_202071e2 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-twinapi-appcore_31bf3856ad364e35_10.0.15063.0_none_c4afd53ef6b024d5.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.15063.0_none_210709721af4ec88_cryptdll.dll_e0da7eac 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_it-it_e4e0927161ba0fe9.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_en-us_507ecdc8096d0ff0_webclnt.dll.mui_e8f04040 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_es-mx_d67951fba51d1817_bootmgr.exe.mui_c434701f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_da-dk_55fac28eee7d50cf.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.15063.0_none_26f0788116f5471e.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_fb5f79a44d5c1ae9.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_10.0.15063.0_none_7c26291346c6844d_wtsapi32.dll_470d4d41 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.15063.0_en-us_af1aa8cbf99dbd7d.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rpc-local_31bf3856ad364e35_10.0.15063.0_none_c50e78507de308c7_rpcrt4.dll_5aa847dd 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_en-us_dd56529205f2b805_netiougc.exe.mui_ad7a9e4d 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_61f5adcf622ceaac.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_lv-lv_06be8d86c3187ada_bootmgfw.efi.mui_a6e78cfa 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.15063.0_none_d8565387b13c2e24.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice_31bf3856ad364e35_10.0.15063.0_none_bb1659e5012b4fbe_themeservice.dll_223a3220 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.15063.0_none_fa7db1d69e32c652_winbrand.dll_9cd6a3cf 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..update-genuineintel_31bf3856ad364e35_10.0.15063.0_none_cdd3e59aeb1c07ac.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f2e55c68b9b08e2_scarddlg.dll.mui_300ae9df 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-version_31bf3856ad364e35_10.0.15063.0_none_2612286889b4755c.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_e617457ad1e00a3e_bootmgr.exe.mui_c434701f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-us_6e46cf1f2108348c_comctl32.dll.mui_0da4e682 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_20edd7ef9e21d8cb_rasacd.sys_43640ee7 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.15063.0_en-us_727c27262b7ec707.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_74d4adceeb3499bf.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..opwindowmanager-api_31bf3856ad364e35_10.0.15063.0_none_fb776818ad2cd657.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_3fe4b2c9ef33a509_applockerfltr.sys_6a9d2cba 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi32_31bf3856ad364e35_10.0.15063.0_none_6a928335822044d3_gdi32.dll_1f014d57 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_hr-hr_40f4f6ac6faa981f_msimsg.dll.mui_72e8994f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-directui_31bf3856ad364e35_10.0.15063.0_none_d25e77385bc57ad6_windows.ui.xaml.resources.dll_3a1e5f1c 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ar-sa_67778a441a2f274e_msimsg.dll.mui_72e8994f 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-duser_31bf3856ad364e35_10.0.15063.0_none_6b88878235493b61_duser.dll_a2bd2fa9 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_app852.fon_e3869f49 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.15063.0_none_7199b2a6f00baf63.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.15063.0_none_7153f6fb947272a7.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ar-sa_c50cf4a0af973ef3_comctl32.dll.mui_0da4e682 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9_dwm.exe_04cf416e 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_10.0.15063.0_none_291118dda2c1a1ca_scardsvr.dll_b84d047c 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.15063.0_none_39373b181fd15f6d_gpsvc.dll_970be02b 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_108ceb72e3e4e2a9.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.15063.0_none_85ed41598f9336e6_oleacc.dll_2f3fa5bf 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_en-us_67aabff02c2da9b2_iscsidsc.dll.mui_6acb64a6 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.15063.0_none_ffa06ca6283461f7.manifest 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_f03011c634d83a8f_mofcomp.exe.mui_35badf56 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_15a35bae90857b0c_listsvc.dll.mui_27f0fc85 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.15063.0_none_9e47f44c3a5e979a_netapi32.dll_8b1e859a 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.15063.0_none_f5ad4336b7886518_lsaiso.exe_51c00eb7 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_uk-ua_50a2c75f3aa739c5_comctl32.dll.mui_0da4e682 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 744 vssadmin.exe -
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1d000000010000001000000054e2cd85ba79cda018fed9e6a863aa461400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b276200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f553000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000132020004700320000000f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\48504E974C0DAC5B5CD476C8202274B24C8C7172 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\48504E974C0DAC5B5CD476C8202274B24C8C7172\Blob = 03000000010000001400000048504e974c0dac5b5cd476c8202274b24c8c7172140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000312128f5a0ed7ba54b6582928756ba830f00000001000000200000003286ff65a65faf32085eea1388c3738ba7e37873c906cce3c4a28b4cc2a58988190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000006cf252fec3e8f20996de5d4dd9aef424200000000100000069040000308204653082034da0030201020210400175048314a4c8218c84a90c16cddf300d06092a864886f70d01010b0500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3230313030373139323134305a170d3231303932393139323134305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a38201683082016430120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186304b06082b06010505070101043f303d303b06082b06010505073002862f687474703a2f2f617070732e6964656e74727573742e636f6d2f726f6f74732f647374726f6f74636178332e703763301f0603551d23041830168014c4a7b1a47b2c71fadbe14b9075ffc4156085891030540603551d20044d304b3008060667810c010201303f060b2b0601040182df130101013030302e06082b060105050702011622687474703a2f2f6370732e726f6f742d78312e6c657473656e63727970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100d94ce0c9f584883731dbbb13e2b3fc8b6b62126c58b7497e3c02b7a81f2861ebcee02e73ef49077a35841f1dad68f0d8fe56812f6d7f58a66e3536101c73c3e5bd6d5e01d76e72fb2aa0b8d35764e55bc269d4d0b2f77c4bc3178e887273dcfdfc6dbde3c90b8e613a16587d74362b55803dc763be8443c639a10e6b579e3f29c180f6b2bd47cbaa306cb732e159540b1809175e636cfb96673c1c730c938bc611762486de400707e47d2d66b525a39658c8ea80eecf693b96fce68dc033f389f8292d14142d7ef06170955df70be5c0fb24faec8ecb61c8ee637128a82c053b77ef9b5e0364f051d1e485535cb00297d47ec634d2ce1000e4b1df3ac2ea17be 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exepid process 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2772 vssvc.exe Token: SeRestorePrivilege 2772 vssvc.exe Token: SeAuditPrivilege 2772 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.execmd.exedescription pid process target process PID 2016 wrote to memory of 2184 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe cmd.exe PID 2016 wrote to memory of 2184 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe cmd.exe PID 2016 wrote to memory of 2184 2016 0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe cmd.exe PID 2184 wrote to memory of 744 2184 cmd.exe vssadmin.exe PID 2184 wrote to memory of 744 2184 cmd.exe vssadmin.exe PID 2184 wrote to memory of 744 2184 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe"C:\Users\Admin\AppData\Local\Temp\0d7f296d0b7ad462d55d49c374ef271f5898c3487192bff7b157942280b876b6.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:744
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-120-0x0000000000000000-mapping.dmp
-
memory/2016-114-0x0000000000910000-0x000000000091A000-memory.dmpFilesize
40KB
-
memory/2016-115-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/2016-117-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/2016-116-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/2016-118-0x0000000000B10000-0x0000000000B16000-memory.dmpFilesize
24KB
-
memory/2184-119-0x0000000000000000-mapping.dmp