Analysis
-
max time kernel
1719s -
max time network
1842s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-08-2021 11:08
Static task
static1
Behavioral task
behavioral1
Sample
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
Resource
win10v20210410
General
-
Target
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
-
Size
911KB
-
MD5
0299e3c2536543885860c7b61e1efc3f
-
SHA1
682389250d914b95d6c23ab29dffee11cb65cae9
-
SHA256
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e
-
SHA512
f451031bc12e096a50b19f80422e9db5b6913f22ceab000f0dfb5aca767ff0b7fc25ee75482875bc9f2fa1953aaf06b3f50ec2ecb901b31f5e27ffd0707f2781
Malware Config
Extracted
C:\8j0whp2ohc-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/59F618335FC07CB0
http://decoder.re/59F618335FC07CB0
Extracted
sodinokibi
$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm
7598
ecoledansemulhouse.fr
promesapuertorico.com
oldschoolfun.net
hardinggroup.com
fax-payday-loans.com
chrissieperry.com
chandlerpd.com
birnam-wood.com
ivfminiua.com
berlin-bamboo-bikes.org
vesinhnha.com.vn
geisterradler.de
lefumetdesdombes.com
slimani.net
vyhino-zhulebino-24.ru
lusak.at
101gowrie.com
pixelarttees.com
live-your-life.jp
yamalevents.com
ivivo.es
pcprofessor.com
milanonotai.it
brevitempore.net
herbayupro.com
securityfmm.com
rerekatu.com
highlinesouthasc.com
oncarrot.com
freie-baugutachterpraxis.de
365questions.org
arteservicefabbro.com
augenta.com
creamery201.com
expandet.dk
bristolaeroclub.co.uk
answerstest.ru
schoellhammer.com
jenniferandersonwriter.com
associationanalytics.com
lapinvihreat.fi
mdk-mediadesign.de
gasbarre.com
effortlesspromo.com
sla-paris.com
cleliaekiko.online
tstaffing.nl
hairnetty.wordpress.com
cnoia.org
bodyfulls.com
maryloutaylor.com
pogypneu.sk
memaag.com
4net.guru
d1franchise.com
ilso.net
www1.proresult.no
campus2day.de
transportesycementoshidalgo.es
bingonearme.org
wolf-glas-und-kunst.de
iwr.nl
turkcaparbariatrics.com
solhaug.tk
oneheartwarriors.at
paulisdogshop.de
hellohope.com
stingraybeach.com
4youbeautysalon.com
vitavia.lt
precisionbevel.com
live-con-arte.de
crowd-patch.co.uk
carrybrands.nl
web.ion.ag
rosavalamedahr.com
verytycs.com
tecnojobsnet.com
onlyresultsmarketing.com
rocketccw.com
artige.com
danielblum.info
smejump.co.th
craigmccabe.fun
igrealestate.com
gopackapp.com
polymedia.dk
theduke.de
thefixhut.com
forskolorna.org
educar.org
fayrecreations.com
thailandholic.com
allfortheloveofyou.com
intecwi.com
labobit.it
abuelos.com
rota-installations.co.uk
rieed.de
xlarge.at
levdittliv.se
paradicepacks.com
jadwalbolanet.info
bodyforwife.com
c2e-poitiers.com
architecturalfiberglass.org
solerluethi-allart.ch
whittier5k.com
fotoideaymedia.es
art2gointerieurprojecten.nl
jbbjw.com
waermetauscher-berechnen.de
rumahminangberdaya.com
dr-seleznev.com
cortec-neuro.com
simpliza.com
tastewilliamsburg.com
bigasgrup.com
withahmed.com
copystar.co.uk
sotsioloogia.ee
mrsfieldskc.com
dr-tremel-rednitzhembach.de
maratonaclubedeportugal.com
architekturbuero-wagner.net
firstpaymentservices.com
greenfieldoptimaldentalcare.com
markelbroch.com
cafemattmeera.com
homecomingstudio.com
suncrestcabinets.ca
webmaster-peloton.com
craigvalentineacademy.com
loprus.pl
aunexis.ch
aakritpatel.com
yassir.pro
kao.at
geekwork.pl
brigitte-erler.com
pivoineetc.fr
cirugiauretra.es
xn--rumung-bua.online
profectis.de
starsarecircular.org
frontierweldingllc.com
devstyle.org
moveonnews.com
lascuola.nl
charlottepoudroux-photographie.fr
travelffeine.com
johnsonfamilyfarmblog.wordpress.com
uranus.nl
denifl-consulting.at
ledmes.ru
almosthomedogrescue.dog
wien-mitte.co.at
onlybacklink.com
adoptioperheet.fi
danubecloud.com
elpa.se
ussmontanacommittee.us
bee4win.com
sobreholanda.com
real-estate-experts.com
iwelt.de
neuschelectrical.co.za
mooglee.com
humanityplus.org
em-gmbh.ch
commonground-stories.com
associacioesportivapolitg.cat
todocaracoles.com
div-vertriebsforschung.de
alhashem.net
austinlchurch.com
reddysbakery.com
levihotelspa.fi
systemate.dk
35-40konkatsu.net
1team.es
chefdays.de
ravensnesthomegoods.com
xn--vrftet-pua.biz
abogadosaccidentetraficosevilla.es
shiresresidential.com
stoeferlehalle.de
tigsltd.com
smartypractice.com
finde-deine-marke.de
hoteledenpadova.it
argos.wityu.fund
dinslips.se
urist-bogatyr.ru
cursoporcelanatoliquido.online
naturalrapids.com
synlab.lt
leoben.at
seevilla-dr-sturm.at
epwritescom.wordpress.com
drugdevice.org
uimaan.fi
pasivect.co.uk
ceres.org.au
noesis.tech
supportsumba.nl
beyondmarcomdotcom.wordpress.com
kamienny-dywan24.pl
insigniapmg.com
idemblogs.com
lbcframingelectrical.com
lukeshepley.wordpress.com
nancy-informatique.fr
kunze-immobilien.de
buymedical.biz
alvinschwartz.wordpress.com
executiveairllc.com
dublikator.com
qlog.de
henricekupper.com
surespark.org.uk
body-guards.it
michaelsmeriglioracing.com
gadgetedges.com
basisschooldezonnewijzer.nl
wmiadmin.com
klimt2012.info
delawarecorporatelaw.com
schutting-info.nl
skanah.com
karacaoglu.nl
gonzalezfornes.es
vermoote.de
pointos.com
hushavefritid.dk
tsklogistik.eu
revezlimage.com
havecamerawilltravel2017.wordpress.com
mountsoul.de
juneauopioidworkgroup.org
friendsandbrgrs.com
woodworkersolution.com
lynsayshepherd.co.uk
verbisonline.com
babcockchurch.org
schmalhorst.de
southeasternacademyofprosthodontics.org
luckypatcher-apkz.com
parkstreetauto.net
bradynursery.com
richard-felix.co.uk
naturavetal.hr
biapi-coaching.fr
rksbusiness.com
lecantou-coworking.com
zweerscreatives.nl
marietteaernoudts.nl
advokathuset.dk
centromarysalud.com
aglend.com.au
talentwunder.com
sairaku.net
fatfreezingmachines.com
hotelsolbh.com.br
edgewoodestates.org
penco.ie
mank.de
jorgobe.at
personalenhancementcenter.com
team-montage.dk
bbsmobler.se
burkert-ideenreich.de
id-vet.com
lykkeliv.net
fibrofolliculoma.info
syndikat-asphaltfieber.de
theshungiteexperience.com.au
beaconhealthsystem.org
figura.team
visiativ-industry.fr
foryourhealth.live
danskretursystem.dk
shhealthlaw.com
westdeptfordbuyrite.com
tennisclubetten.nl
creative-waves.co.uk
jyzdesign.com
eco-southafrica.com
oemands.dk
coding-marking.com
deltacleta.cat
abogados-en-alicante.es
baronloan.org
mytechnoway.com
oneplusresource.org
winrace.no
siluet-decor.ru
lange.host
dontpassthepepper.com
bunburyfreightservices.com.au
bouncingbonanza.com
woodleyacademy.org
autopfand24.de
admos-gleitlager.de
bargningavesta.se
xtptrack.com
mapawood.com
igorbarbosa.com
songunceliptv.com
tandartspraktijkheesch.nl
mymoneyforex.com
lescomtesdemean.be
officehymy.com
anthonystreetrimming.com
stacyloeb.com
gamesboard.info
sauschneider.info
scenepublique.net
blewback.com
importardechina.info
acomprarseguidores.com
edelman.jp
evergreen-fishing.com
advizewealth.com
alfa-stroy72.com
macabaneaupaysflechois.com
bildungsunderlebnis.haus
justinvieira.com
transliminaltribe.wordpress.com
bundabergeyeclinic.com.au
xn--singlebrsen-vergleich-nec.com
trulynolen.co.uk
mrtour.site
you-bysia.com.au
praxis-management-plus.de
innote.fi
vickiegrayimages.com
devlaur.com
wacochamber.com
no-plans.com
vancouver-print.ca
xn--fn-kka.no
plantag.de
wari.com.pe
tenacitytenfold.com
nijaplay.com
danholzmann.com
xn--fnsterputssollentuna-39b.se
walkingdeadnj.com
qualitus.com
tonelektro.nl
colorofhorses.com
theclubms.com
journeybacktolife.com
mooshine.com
ecopro-kanto.com
presseclub-magdeburg.de
ditog.fr
facettenreich27.de
lmtprovisions.com
antenanavi.com
adultgamezone.com
quizzingbee.com
irinaverwer.com
cactusthebrand.com
kevinjodea.com
bloggyboulga.net
mediaplayertest.net
ilive.lt
smalltownideamill.wordpress.com
thaysa.com
bargningharnosand.se
ohidesign.com
tophumanservicescourses.com
321play.com.hk
micahkoleoso.de
vdberg-autoimport.nl
urclan.net
heliomotion.com
blog.solutionsarchitect.guru
psa-sec.de
myteamgenius.com
simulatebrain.com
besttechie.com
mepavex.nl
familypark40.com
insp.bi
dpo-as-a-service.com
cursosgratuitosnainternet.com
biortaggivaldelsa.com
piajeppesen.dk
anybookreader.de
tongdaifpthaiphong.net
wurmpower.at
global-kids.info
brandl-blumen.de
first-2-aid-u.com
kisplanning.com.au
psnacademy.in
aselbermachen.com
mrxermon.de
gasolspecialisten.se
id-et-d.fr
tinyagency.com
deoudedorpskernnoordwijk.nl
testzandbakmetmening.online
limassoldriving.com
shonacox.com
durganews.com
globedivers.wordpress.com
mirjamholleman.nl
mooreslawngarden.com
luxurytv.jp
coastalbridgeadvisors.com
chatizel-paysage.fr
slimidealherbal.com
remcakram.com
fiscalsort.com
osterberg.fi
boulderwelt-muenchen-west.de
esope-formation.fr
parking.netgateway.eu
gastsicht.de
filmvideoweb.com
pelorus.group
galserwis.pl
asteriag.com
alten-mebel63.ru
dutchbrewingcoffee.com
spsshomeworkhelp.com
smhydro.com.pl
rushhourappliances.com
ctrler.cn
zewatchers.com
zimmerei-fl.de
alysonhoward.com
forestlakeuca.org.au
myzk.site
phantastyk.com
narcert.com
dnepr-beskid.com.ua
evangelische-pfarrgemeinde-tuniberg.de
darnallwellbeing.org.uk
charlesreger.com
purposeadvisorsolutions.com
gporf.fr
knowledgemuseumbd.com
amerikansktgodis.se
appsformacpc.com
ftf.or.at
proudground.org
operaslovakia.sk
iviaggisonciliegie.it
boosthybrid.com.au
norovirus-ratgeber.de
apprendrelaudit.com
gymnasedumanagement.com
miriamgrimm.de
mbxvii.com
smokeysstoves.com
zzyjtsgls.com
funjose.org.gt
carolinepenn.com
nhadatcanho247.com
chavesdoareeiro.com
baumkuchenexpo.jp
linnankellari.fi
vox-surveys.com
bockamp.com
maasreusel.nl
pay4essays.net
webcodingstudio.com
zonamovie21.net
groupe-frayssinet.fr
mediaacademy-iraq.org
waynela.com
toreria.es
sloverse.com
cityorchardhtx.com
corelifenutrition.com
faronics.com
gantungankunciakrilikbandung.com
pv-design.de
csgospeltips.se
xn--thucmctc-13a1357egba.com
raschlosser.de
dubnew.com
airconditioning-waalwijk.nl
abitur-undwieweiter.de
caffeinternet.it
joseconstela.com
hihaho.com
kuntokeskusrok.fi
notsilentmd.org
garage-lecompte-rouen.fr
x-ray.ca
bordercollie-nim.nl
gemeentehetkompas.nl
slashdb.com
zso-mannheim.de
conasmanagement.de
diversiapsicologia.es
ai-spt.jp
blumenhof-wegleitner.at
ladelirante.fr
noskierrenteria.com
minipara.com
liikelataamo.fi
hannah-fink.de
dekkinngay.com
caribdoctor.org
ateliergamila.com
romeguidedvisit.com
higadograsoweb.com
deepsouthclothingcompany.com
behavioralmedicinespecialists.com
bastutunnan.se
fitnessbazaar.com
lightair.com
craftleathermnl.com
falcou.fr
stoeberstuuv.de
hashkasolutindo.com
unetica.fr
huissier-creteil.com
sporthamper.com
musictreehouse.net
fensterbau-ziegler.de
crediacces.com
femxarxa.cat
triggi.de
pt-arnold.de
midmohandyman.com
corola.es
maineemploymentlawyerblog.com
itelagen.com
imadarchid.com
i-arslan.de
socstrp.org
tomaso.gr
projetlyonturin.fr
mir-na-iznanku.com
retroearthstudio.com
helenekowalsky.com
theadventureedge.com
modelmaking.nl
drnice.de
sojamindbody.com
themadbotter.com
naturstein-hotte.de
hrabritelefon.hr
antiaginghealthbenefits.com
partnertaxi.sk
ecpmedia.vn
pcp-nc.com
balticdermatology.lt
ra-staudte.de
praxis-foerderdiagnostik.de
gmto.fr
farhaani.com
restaurantesszimmer.de
connectedace.com
christinarebuffetcourses.com
tanzprojekt.com
spacecitysisters.org
urmasiimariiuniri.ro
otsu-bon.com
international-sound-awards.com
foretprivee.ca
joyeriaorindia.com
nachhilfe-unterricht.com
lachofikschiet.nl
blogdecachorros.com
ikads.org
mediaclan.info
aprepol.com
whyinterestingly.ru
igfap.com
stemenstilte.nl
lubetkinmediacompanies.com
kindersitze-vergleich.de
ouryoungminds.wordpress.com
theapifactory.com
freie-gewerkschaften.de
hokagestore.com
ziegler-praezisionsteile.de
fannmedias.com
summitmarketingstrategies.com
mdacares.com
kmbshipping.co.uk
hatech.io
goodgirlrecovery.com
leather-factory.co.jp
launchhubl.com
jakekozmor.com
celeclub.org
simpkinsedwards.co.uk
autofolierung-lu.de
pasvenska.se
shsthepapercut.com
aodaichandung.com
kafu.ch
corona-handles.com
sipstroysochi.ru
qualitaetstag.de
solinegraphic.com
latribuessentielle.com
pmcimpact.com
nestor-swiss.ch
thewellnessmimi.com
takeflat.com
kaliber.co.jp
milsing.hr
spectrmash.ru
stormwall.se
galleryartfair.com
irishmachineryauctions.com
ausair.com.au
bookspeopleplaces.com
puertamatic.es
love30-chanko.com
teknoz.net
centuryrs.com
artotelamsterdam.com
anteniti.com
DupontSellsHomes.com
commercialboatbuilding.com
noixdecocom.fr
lillegrandpalais.com
cerebralforce.net
waveneyrivercentre.co.uk
selfoutlet.com
hexcreatives.co
smessier.com
leeuwardenstudentcity.nl
spargel-kochen.de
delchacay.com.ar
bouldercafe-wuppertal.de
lapmangfpt.info.vn
pubweb.carnet.hr
wellplast.se
greenko.pl
fitnessingbyjessica.com
thomas-hospital.de
unim.su
collaborativeclassroom.org
tandartspraktijkhartjegroningen.nl
kojima-shihou.com
coursio.com
the-virtualizer.com
verifort-capital.de
euro-trend.pl
drinkseed.com
sportiomsportfondsen.nl
mmgdouai.fr
marketingsulweb.com
peterstrobos.com
cheminpsy.fr
panelsandwichmadrid.es
stopilhan.com
kingfamily.construction
chaotrang.com
dirittosanitario.biz
bridgeloanslenders.com
employeesurveys.com
saarland-thermen-resort.com
sachnendoc.com
icpcnj.org
homng.net
roygolden.com
geoffreymeuli.com
ogdenvision.com
parebrise-tla.fr
renergysolution.com
hvccfloorcare.com
mezhdu-delom.ru
run4study.com
navyfederalautooverseas.com
vetapharma.fr
smogathon.com
ahouseforlease.com
d2marketing.co.uk
bestbet.com
aminaboutique247.com
wraithco.com
iphoneszervizbudapest.hu
mercantedifiori.com
brawnmediany.com
zieglerbrothers.de
worldhealthbasicinfo.com
otto-bollmann.de
financescorecard.com
villa-marrakesch.de
simplyblessedbykeepingitreal.com
amylendscrestview.com
pinkexcel.com
montrium.com
dushka.ua
dlc.berlin
gw2guilds.org
porno-gringo.com
cuppacap.com
aurum-juweliere.de
abl1.net
iyengaryogacharlotte.com
pomodori-pizzeria.de
manifestinglab.com
bsaship.com
kampotpepper.gives
bauertree.com
liveottelut.com
herbstfeststaefa.ch
vietlawconsultancy.com
sabel-bf.com
buroludo.nl
cranleighscoutgroup.org
8449nohate.org
zimmerei-deboer.de
softsproductkey.com
victoriousfestival.co.uk
kissit.ca
dramagickcom.wordpress.com
coffreo.biz
vannesteconstruct.be
cyntox.com
mastertechengineering.com
interactcenter.org
julis-lsa.de
planchaavapor.net
thomasvicino.com
psc.de
quemargrasa.net
leda-ukraine.com.ua
groupe-cets.com
baptisttabernacle.com
embracinghiscall.com
latestmodsapks.com
braffinjurylawfirm.com
tanciu.com
tuuliautio.fi
vorotauu.ru
prochain-voyage.net
naswrrg.org
zenderthelender.com
baylegacy.com
darrenkeslerministries.com
trystana.com
toponlinecasinosuk.co.uk
tips.technology
digi-talents.com
bhwlawfirm.com
manutouchmassage.com
lebellevue.fr
deko4you.at
deprobatehelp.com
datacenters-in-europe.com
theletter.company
heidelbergartstudio.gallery
homesdollar.com
clos-galant.com
ralister.co.uk
coding-machine.com
strandcampingdoonbeg.com
hugoversichert.de
parks-nuernberg.de
jobcenterkenya.com
trapiantofue.it
senson.fi
nsec.se
jerling.de
compliancesolutionsstrategies.com
broseller.com
notmissingout.com
gaiam.nl
spylista.com
thedresserie.com
hmsdanmark.dk
werkkring.nl
quickyfunds.com
roadwarrior.app
happyeasterimages.org
sanyue119.com
sarbatkhalsafoundation.org
xn--logopdie-leverkusen-kwb.de
better.town
filmstreamingvfcomplet.be
dsl-ip.de
walter-lemm.de
n1-headache.com
shiftinspiration.com
elimchan.com
jobmap.at
vloeren-nu.nl
modestmanagement.com
licor43.de
eraorastudio.com
plv.media
erstatningsadvokaterne.dk
wychowanieprzedszkolne.pl
cimanchesterescorts.co.uk
entopic.com
cuspdental.com
odiclinic.org
faizanullah.com
promalaga.es
blossombeyond50.com
punchbaby.com
exenberger.at
lichencafe.com
new.devon.gov.uk
sw1m.ru
beautychance.se
heurigen-bauer.at
citymax-cr.com
vitalyscenter.es
thedad.com
truenyc.co
devok.info
katiekerr.co.uk
radaradvies.nl
nativeformulas.com
dutchcoder.nl
accountancywijchen.nl
kikedeoliveira.com
makeflowers.ru
crowcanyon.com
pferdebiester.de
makeurvoiceheard.com
oslomf.no
alsace-first.com
healthyyworkout.com
ulyssemarketing.com
krcove-zily.eu
ausbeverage.com.au
aarvorg.com
serce.info.pl
twohourswithlena.wordpress.com
space.ua
thee.network
2ekeus.nl
fitovitaforum.com
nosuchthingasgovernment.com
ihr-news.jp
myhostcloud.com
spd-ehningen.de
meusharklinithome.wordpress.com
podsosnami.ru
tulsawaterheaterinstallation.com
berliner-versicherungsvergleich.de
littlebird.salon
skiltogprint.no
agence-referencement-naturel-geneve.net
koken-voor-baby.nl
dareckleyministries.com
nokesvilledentistry.com
kojinsaisei.info
kadesignandbuild.co.uk
mylovelybluesky.com
rozemondcoaching.nl
schlafsack-test.net
daniel-akermann-architektur-und-planung.ch
degroenetunnel.com
fotoscondron.com
lapinlviasennus.fi
highimpactoutdoors.net
actecfoundation.org
klusbeter.nl
logopaedie-blomberg.de
dubscollective.com
kamahouse.net
autodujos.lt
jusibe.com
muamuadolls.com
i-trust.dk
waywithwords.net
cite4me.org
caribbeansunpoker.com
people-biz.com
kosterra.com
nuzech.com
ccpbroadband.com
teczowadolina.bytom.pl
izzi360.com
harveybp.com
girlillamarketing.com
andersongilmour.co.uk
rimborsobancario.net
analiticapublica.es
teresianmedia.org
hypozentrum.com
12starhd.online
webhostingsrbija.rs
croftprecision.co.uk
iqbalscientific.com
veybachcenter.de
drfoyle.com
despedidascostablanca.es
body-armour.online
easytrans.com.au
huesges-gruppe.de
tomoiyuma.com
kariokids.com
allamatberedare.se
argenblogs.com.ar
nandistribution.nl
pridoxmaterieel.nl
mousepad-direkt.de
portoesdofarrobo.com
mirkoreisser.de
sinal.org
sportverein-tambach.de
sanaia.com
tampaallen.com
katketytaanet.fi
jsfg.com
nakupunafoundation.org
catholicmusicfest.com
edv-live.de
ligiercenter-sachsen.de
merzi.info
tanzschule-kieber.de
judithjansen.com
triactis.com
sterlingessay.com
bafuncs.org
slwgs.org
ceid.info.tr
asgestion.com
denovofoodsgroup.com
marathonerpaolo.com
bricotienda.com
rhinosfootballacademy.com
jameskibbie.com
blood-sports.net
asiluxury.com
xltyu.com
vibethink.net
stupbratt.no
paymybill.guru
hkr-reise.de
polychromelabs.com
lloydconstruction.com
sagadc.com
antonmack.de
steampluscarpetandfloors.com
testcoreprohealthuk.com
kaotikkustomz.com
sevenadvertising.com
hhcourier.com
courteney-cox.net
123vrachi.ru
yourobgyn.net
blgr.be
mardenherefordshire-pc.gov.uk
maxadams.london
zervicethai.co.th
microcirc.net
sahalstore.com
pmc-services.de
pocket-opera.de
perbudget.com
atozdistribution.co.uk
socialonemedia.com
yousay.site
digivod.de
krlosdavid.com
hiddencitysecrets.com.au
stoneys.ch
desert-trails.com
echtveilig.nl
bigler-hrconsulting.ch
layrshift.eu
tux-espacios.com
castillobalduz.es
stemplusacademy.com
celularity.com
monark.com
jasonbaileystudio.com
glennroberts.co.nz
milltimber.aberdeen.sch.uk
sportsmassoren.com
autodemontagenijmegen.nl
fizzl.ru
modamilyon.com
wasmachtmeinfonds.at
imaginado.de
grelot-home.com
makeitcount.at
olejack.ru
bogdanpeptine.ro
jolly-events.com
koko-nora.dk
patrickfoundation.net
atalent.fi
comarenterprises.com
boisehosting.net
fundaciongregal.org
spinheal.ru
blacksirius.de
tetinfo.in
rostoncastings.co.uk
vihannesporssi.fi
smithmediastrategies.com
kenhnoithatgo.com
bimnapratica.com
atmos-show.com
upmrkt.co
centrospgolega.com
siliconbeach-realestate.com
iyahayki.nl
opatrovanie-ako.sk
mrsplans.net
completeweddingkansas.com
zflas.com
agence-chocolat-noir.com
smale-opticiens.nl
trackyourconstruction.com
fairfriends18.de
stallbyggen.se
streamerzradio1.site
conexa4papers.trade
philippedebroca.com
haar-spange.com
tarotdeseidel.com
nataschawessels.com
eglectonk.online
bowengroup.com.au
fransespiegels.nl
christ-michael.net
backstreetpub.com
wsoil.com.sg
handi-jack-llc.com
edrcreditservices.nl
newstap.com.ng
petnest.ir
milestoneshows.com
tinkoff-mobayl.ru
shadebarandgrillorlando.com
lorenacarnero.com
nurturingwisdom.com
camsadviser.com
plotlinecreative.com
gratispresent.se
lionware.de
videomarketing.pro
1kbk.com.ua
bayoga.co.uk
hairstylesnow.site
kostenlose-webcams.com
marchand-sloboda.com
calabasasdigest.com
nmiec.com
deschl.net
ncid.bc.ca
americafirstcommittee.org
kedak.de
dr-pipi.de
outcomeisincome.com
newyou.at
strategicstatements.com
miraclediet.fun
htchorst.nl
ventti.com.ar
boldcitydowntown.com
rebeccarisher.com
kalkulator-oszczednosci.pl
bxdf.info
tradiematepro.com.au
offroadbeasts.com
binder-buerotechnik.at
sexandfessenjoon.wordpress.com
maureenbreezedancetheater.org
torgbodenbollnas.se
madinblack.com
platformier.com
eaglemeetstiger.de
comparatif-lave-linge.fr
slupetzky.at
harpershologram.wordpress.com
calxplus.eu
classycurtainsltd.co.uk
evologic-technologies.com
hebkft.hu
stefanpasch.me
ostheimer.at
ora-it.de
rafaut.com
campusoutreach.org
jandaonline.com
ontrailsandboulevards.com
sandd.nl
jacquin-maquettes.com
xoabigail.com
polzine.net
baustb.de
malychanieruchomoscipremium.com
mylolis.com
kaminscy.com
micro-automation.de
bigbaguettes.eu
daklesa.de
humancondition.com
extensionmaison.info
abogadoengijon.es
morawe-krueger.de
all-turtles.com
botanicinnovations.com
pickanose.com
symphonyenvironmental.com
houseofplus.com
mbfagency.com
haremnick.com
thenewrejuveme.com
jvanvlietdichter.nl
imperfectstore.com
cwsitservices.co.uk
boompinoy.com
nvwoodwerks.com
saka.gr
insidegarage.pl
ymca-cw.org.uk
longislandelderlaw.com
nicoleaeschbachorg.wordpress.com
seproc.hn
allentownpapershow.com
greenpark.ch
liliesandbeauties.org
bouquet-de-roses.com
schoolofpassivewealth.com
pawsuppetlovers.com
seitzdruck.com
directwindowco.com
grupocarvalhoerodrigues.com.br
plastidip.com.ar
helikoptervluchtnewyork.nl
troegs.com
ilcdover.com
simoneblum.de
ruralarcoiris.com
norpol-yachting.com
hotelzentral.at
ianaswanson.com
the-domain-trader.com
mikeramirezcpa.com
kirkepartner.dk
ungsvenskarna.se
seagatesthreecharters.com
jeanlouissibomana.com
ki-lowroermond.nl
aco-media.nl
finediningweek.pl
extraordinaryoutdoors.com
servicegsm.net
artallnightdc.com
pierrehale.com
kath-kirche-gera.de
allure-cosmetics.at
carlosja.com
resortmtn.com
nacktfalter.de
stampagrafica.es
rehabilitationcentersinhouston.net
samnewbyjax.com
corendonhotels.com
lucidinvestbank.com
bptdmaluku.com
oceanastudios.com
controldekk.com
work2live.de
enovos.de
assurancesalextrespaille.fr
jiloc.com
eadsmurraypugh.com
schraven.de
candyhouseusa.com
flexicloud.hk
lenreactiv-shop.ru
destinationclients.fr
myhealth.net.au
saxtec.com
huehnerauge-entfernen.de
vanswigchemdesign.com
pier40forall.org
instatron.net
mariposapropaneaz.com
dw-css.de
balticdentists.com
carriagehousesalonvt.com
physiofischer.de
poultrypartners.nl
c-a.co.in
ino-professional.ru
vibehouse.rw
rollingrockcolumbia.com
seminoc.com
parkcf.nl
mountaintoptinyhomes.com
dezatec.es
readberserk.com
smart-light.co.uk
upplandsspar.se
ampisolabergeggi.it
satyayoga.de
abogadosadomicilio.es
kidbucketlist.com.au
ncs-graphic-studio.com
ftlc.es
ncuccr.org
manijaipur.com
marcuswhitten.site
bierensgebakkramen.nl
y-archive.com
mindpackstudios.com
refluxreducer.com
sofavietxinh.com
sweering.fr
aniblinova.wordpress.com
faroairporttransfers.net
consultaractadenacimiento.com
crosspointefellowship.church
apolomarcas.com
-
net
true
-
pid
$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm
-
prc
encsvc
powerpnt
xfssvccon
oracle
thebat
ocssd
sql
msaccess
mydesktopservice
visio
winword
dbeng50
ocomm
mspub
isqlplussvc
infopath
ocautoupds
tbirdconfig
synctime
agntsvc
wordpad
firefox
thunderbird
onenote
dbsnmp
excel
sqbcoreservice
steam
mydesktopqos
outlook
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7598
-
svc
backup
svc$
veeam
sophos
sql
mepocs
vss
memtas
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
Executes dropped EXE 1 IoCs
Processes:
MsMpEng.exepid process 1848 MsMpEng.exe -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
MsMpEng.exedescription ioc process File renamed C:\Users\Admin\Pictures\CopyUnregister.tiff => \??\c:\users\admin\pictures\CopyUnregister.tiff.8j0whp2ohc MsMpEng.exe File renamed C:\Users\Admin\Pictures\InvokeBackup.png => \??\c:\users\admin\pictures\InvokeBackup.png.8j0whp2ohc MsMpEng.exe File renamed C:\Users\Admin\Pictures\PublishComplete.raw => \??\c:\users\admin\pictures\PublishComplete.raw.8j0whp2ohc MsMpEng.exe File renamed C:\Users\Admin\Pictures\OpenMove.tif => \??\c:\users\admin\pictures\OpenMove.tif.8j0whp2ohc MsMpEng.exe File renamed C:\Users\Admin\Pictures\TestUnregister.crw => \??\c:\users\admin\pictures\TestUnregister.crw.8j0whp2ohc MsMpEng.exe File opened for modification \??\c:\users\admin\pictures\ConfirmOut.tiff MsMpEng.exe File opened for modification \??\c:\users\admin\pictures\CopyUnregister.tiff MsMpEng.exe File renamed C:\Users\Admin\Pictures\ConfirmOut.tiff => \??\c:\users\admin\pictures\ConfirmOut.tiff.8j0whp2ohc MsMpEng.exe File renamed C:\Users\Admin\Pictures\UseReset.tif => \??\c:\users\admin\pictures\UseReset.tif.8j0whp2ohc MsMpEng.exe -
Loads dropped DLL 2 IoCs
Processes:
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exeMsMpEng.exepid process 800 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe 1848 MsMpEng.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MsMpEng.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zQS1XtGvA8 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MsMpEng.exe" MsMpEng.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MsMpEng.exedescription ioc process File opened (read-only) \??\B: MsMpEng.exe File opened (read-only) \??\M: MsMpEng.exe File opened (read-only) \??\U: MsMpEng.exe File opened (read-only) \??\Z: MsMpEng.exe File opened (read-only) \??\T: MsMpEng.exe File opened (read-only) \??\D: MsMpEng.exe File opened (read-only) \??\F: MsMpEng.exe File opened (read-only) \??\K: MsMpEng.exe File opened (read-only) \??\O: MsMpEng.exe File opened (read-only) \??\Q: MsMpEng.exe File opened (read-only) \??\S: MsMpEng.exe File opened (read-only) \??\P: MsMpEng.exe File opened (read-only) \??\X: MsMpEng.exe File opened (read-only) \??\A: MsMpEng.exe File opened (read-only) \??\G: MsMpEng.exe File opened (read-only) \??\H: MsMpEng.exe File opened (read-only) \??\I: MsMpEng.exe File opened (read-only) \??\N: MsMpEng.exe File opened (read-only) \??\W: MsMpEng.exe File opened (read-only) \??\Y: MsMpEng.exe File opened (read-only) \??\E: MsMpEng.exe File opened (read-only) \??\J: MsMpEng.exe File opened (read-only) \??\L: MsMpEng.exe File opened (read-only) \??\R: MsMpEng.exe File opened (read-only) \??\V: MsMpEng.exe -
Drops file in System32 directory 1 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsMpEng.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
MsMpEng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\71v873d7ijm.bmp" MsMpEng.exe -
Drops file in Program Files directory 32 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification \??\c:\program files\DismountSplit.wmf MsMpEng.exe File opened for modification \??\c:\program files\ResolveSet.tmp MsMpEng.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\8j0whp2ohc-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\StartConfirm.TTS MsMpEng.exe File opened for modification \??\c:\program files\WaitAssert.nfo MsMpEng.exe File opened for modification \??\c:\program files\UseProtect.rtf MsMpEng.exe File opened for modification \??\c:\program files\WriteSearch.wm MsMpEng.exe File created \??\c:\program files (x86)\8j0whp2ohc-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\FormatWatch.xml MsMpEng.exe File opened for modification \??\c:\program files\MergeSuspend.search-ms MsMpEng.exe File opened for modification \??\c:\program files\SplitConvert.potx MsMpEng.exe File opened for modification \??\c:\program files\ConnectUpdate.rar MsMpEng.exe File opened for modification \??\c:\program files\LimitPing.pot MsMpEng.exe File opened for modification \??\c:\program files\FormatMeasure.cfg MsMpEng.exe File opened for modification \??\c:\program files\SendAssert.iso MsMpEng.exe File opened for modification \??\c:\program files\UnregisterEnter.asf MsMpEng.exe File created \??\c:\program files\8j0whp2ohc-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\ExportUnprotect.vstx MsMpEng.exe File opened for modification \??\c:\program files\ResolveTest.mp2 MsMpEng.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\8j0whp2ohc-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\BackupPing.mid MsMpEng.exe File opened for modification \??\c:\program files\ConvertToApprove.vstm MsMpEng.exe File opened for modification \??\c:\program files\StartInitialize.au MsMpEng.exe File opened for modification \??\c:\program files\ConvertToMount.otf MsMpEng.exe File opened for modification \??\c:\program files\EnableWrite.TTS MsMpEng.exe File opened for modification \??\c:\program files\InitializeSearch.reg MsMpEng.exe File opened for modification \??\c:\program files\PingDisconnect.mp3 MsMpEng.exe File opened for modification \??\c:\program files\RegisterInvoke.mpeg3 MsMpEng.exe File opened for modification \??\c:\program files\RepairAdd.iso MsMpEng.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\8j0whp2ohc-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\AssertApprove.css MsMpEng.exe File opened for modification \??\c:\program files\BackupCompare.emf MsMpEng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
MsMpEng.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MsMpEng.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF MsMpEng.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb96180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 MsMpEng.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB MsMpEng.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004\Blob = 0300000001000000140000002f7aa2d86056a8775796f798c481a079e538e00414000000010000001400000012c9889b2fc9447a7d12f1df4003429892c724d6040000000100000010000000249f06a9652b2112fc4d7368e6372fec0f00000001000000200000008929be84b4db8bea07b5a70b3bc65a39b1e9b28722689c21893afae875b2ed0c190000000100000010000000d0e6e37d30133bf9aa9f1b76135668421800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000550500003082055130820439a00302010202100c08966535b942a9735265e4f97540bc300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3230303731363132323134345a170d3233303533313233353935395a3059310b300906035504061302555331153013060355040a130c446967694365727420496e63313330310603550403132a47656f547275737420544c5320445620525341204d697865642053484132353620323032302043412d3130820122300d06092a864886f70d01010105000382010f003082010a0282010100b3bd41fb6be6dfa251bf541463c675a651eee388a73a78a09b9e5b917ca5a85933fac66c0750339979fa53f1cc16dde5a69961d34da2ef939402e4c4c95f97d11a6e09da34540bb238c6dd4dad717dbade9bedcb49a04bc363a77f3364b7c7ba7673d21b5286ae9c12e4e7a0ab7cf3efaad5da852308682b1c78e69bafb466fe47d5c18b632c5ccc02f211ded0e9a40c8db9f99accebcc83ab5d84e0aaed19df8f3b553a43b65c114e5af431b6eabd646858109966b2bef39f1a858312a8d7025fec271e6fdf8f80c747edde4b33d31f78b4193b8b13d5f35af35373dd9429245b6d5916cf01c92eeb50450e99f9b6de4527a45e306f8fc3cd4767082d3188c90203010001a382020b30820207301d0603551d0e0416041412c9889b2fc9447a7d12f1df4003429892c724d6301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3081ce0603551d200481c63081c33081c00604551d20003081b7302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818a06082b06010505070202307e0c7c416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652052656c79696e672050617274792041677265656d656e74206c6f63617465642061742068747470733a2f2f7777772e64696769636572742e636f6d2f7270612d7561300d06092a864886f70d01010b050003820101007f4bfc33ba6545c2d8416b8e48ab3c02c8fa11b0e61e714ecc57f7b57473f922b366d3ab97940b27c90eec681a72450ba8875a14c4ba8b178db3b1a576074a0e9852b0f602ab8596ff420ac2f3af50013dc6c7f5834b4ce2c7e300d4df3861f3e914914b7882cca69e7ab2a63afa90f80529512072cc4abd23ec3c6bcb586b2724562ddedc1ebb3bbaa1e7560a02812847f57b2dcb9d13b87959eb40799ae97afc6ef9fa9a410b3b667b87334029f321c619ffc944f5949ff11467e87c13d6bd2313cd2b27d5fe8bba6df3ea58bc17acd14e993c89c12aed7f96c04284c91c31cb3347a1e5f69539909df5aa2b56a10b4df2f54fcd48118e88aec57257a53d12 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f MsMpEng.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 4300000001000000000000000400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 43000000010000000000000004000000010000001000000074014a91b108c458ce47cdf0dd1153080f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5111900000001000000100000000790dd35d0de1a5516689a62748c58eb03000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf1d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000002000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 190000000100000010000000ee8d49b7586d213f273a2c1e1b11bffb0400000001000000100000008714ab83c4041bf193c750e2d721ebef0f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb1903000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd1d0000000100000010000000d895a1485825711bece16ab985d86da21400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c050b000000010000001600000049007a0065006e00700065002e0063006f006d00000009000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b060105050802022000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 MsMpEng.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 MsMpEng.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
MsMpEng.exepid process 1848 MsMpEng.exe 1848 MsMpEng.exe 1848 MsMpEng.exe 1848 MsMpEng.exe 1848 MsMpEng.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
MsMpEng.exevssvc.exedescription pid process Token: SeDebugPrivilege 1848 MsMpEng.exe Token: SeTakeOwnershipPrivilege 1848 MsMpEng.exe Token: SeBackupPrivilege 1952 vssvc.exe Token: SeRestorePrivilege 1952 vssvc.exe Token: SeAuditPrivilege 1952 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exedescription pid process target process PID 800 wrote to memory of 1848 800 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe MsMpEng.exe PID 800 wrote to memory of 1848 800 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe MsMpEng.exe PID 800 wrote to memory of 1848 800 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe MsMpEng.exe PID 800 wrote to memory of 1848 800 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe MsMpEng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe"C:\Users\Admin\AppData\Local\Temp\df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:412
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
MD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
MD5
849fb558745e4089a8232312594b21d2
SHA11bcf1ae39b898aaa8b6b0207d7e307b234614ff6
SHA256d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20
SHA51248d1e77e426d0a96b55e54c4cd81e8376395f17fe1efa5f11467ecfa8f214c52cc202c561be76ddc8a9958fbba74250947fba0310ce9febaa46894f7454a2bbb
-
MD5
849fb558745e4089a8232312594b21d2
SHA11bcf1ae39b898aaa8b6b0207d7e307b234614ff6
SHA256d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20
SHA51248d1e77e426d0a96b55e54c4cd81e8376395f17fe1efa5f11467ecfa8f214c52cc202c561be76ddc8a9958fbba74250947fba0310ce9febaa46894f7454a2bbb
-
MD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c