Analysis
-
max time kernel
1797s -
max time network
1800s -
platform
windows10_x64 -
resource
win10-en -
submitted
14-09-2021 08:42
Static task
static1
Behavioral task
behavioral1
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win10-en
General
-
Target
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
-
Size
910KB
-
MD5
18786bfac1be0ddf23ff94c029ca4d63
-
SHA1
3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
-
SHA256
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
-
SHA512
49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
Malware Config
Extracted
C:\636zy6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C81B5715B2216BE3
http://decoder.re/C81B5715B2216BE3
Extracted
sodinokibi
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
7595
hiddencitysecrets.com.au
groupe-frayssinet.fr
rimborsobancario.net
vietlawconsultancy.com
live-your-life.jp
verbisonline.com
sachnendoc.com
htchorst.nl
bridgeloanslenders.com
petnest.ir
myhealth.net.au
gopackapp.com
jenniferandersonwriter.com
logopaedie-blomberg.de
osterberg.fi
bierensgebakkramen.nl
refluxreducer.com
thenewrejuveme.com
alvinschwartz.wordpress.com
leoben.at
worldhealthbasicinfo.com
bestbet.com
mooglee.com
extensionmaison.info
mediaacademy-iraq.org
saxtec.com
acomprarseguidores.com
iyahayki.nl
rozemondcoaching.nl
carrybrands.nl
camsadviser.com
brandl-blumen.de
jolly-events.com
eglectonk.online
bloggyboulga.net
manutouchmassage.com
caribbeansunpoker.com
craftleathermnl.com
marathonerpaolo.com
stallbyggen.se
themadbotter.com
remcakram.com
kath-kirche-gera.de
leda-ukraine.com.ua
frontierweldingllc.com
fotoideaymedia.es
pt-arnold.de
bbsmobler.se
newyou.at
zflas.com
mousepad-direkt.de
ruralarcoiris.com
vloeren-nu.nl
faizanullah.com
miraclediet.fun
analiticapublica.es
koko-nora.dk
sanaia.com
gasolspecialisten.se
walkingdeadnj.com
neuschelectrical.co.za
the-domain-trader.com
prochain-voyage.net
jiloc.com
schoellhammer.com
dublikator.com
judithjansen.com
zweerscreatives.nl
bodyforwife.com
whittier5k.com
nicoleaeschbachorg.wordpress.com
finediningweek.pl
andersongilmour.co.uk
hatech.io
catholicmusicfest.com
mezhdu-delom.ru
compliancesolutionsstrategies.com
helenekowalsky.com
coding-marking.com
whyinterestingly.ru
praxis-management-plus.de
bodyfulls.com
advokathuset.dk
punchbaby.com
philippedebroca.com
cortec-neuro.com
burkert-ideenreich.de
hannah-fink.de
ceres.org.au
antenanavi.com
no-plans.com
gadgetedges.com
renergysolution.com
uranus.nl
forskolorna.org
greenpark.ch
kaliber.co.jp
bsaship.com
faronics.com
miriamgrimm.de
harpershologram.wordpress.com
conasmanagement.de
yamalevents.com
vancouver-print.ca
tecnojobsnet.com
caffeinternet.it
kadesignandbuild.co.uk
julis-lsa.de
fiscalsort.com
maxadams.london
nacktfalter.de
ungsvenskarna.se
schlafsack-test.net
eraorastudio.com
michaelsmeriglioracing.com
foryourhealth.live
transliminaltribe.wordpress.com
lillegrandpalais.com
lionware.de
paymybill.guru
enovos.de
noskierrenteria.com
thewellnessmimi.com
ctrler.cn
flexicloud.hk
daniel-akermann-architektur-und-planung.ch
solerluethi-allart.ch
mylovelybluesky.com
hotelzentral.at
extraordinaryoutdoors.com
ftf.or.at
cactusthebrand.com
scenepublique.net
iwelt.de
thomasvicino.com
tstaffing.nl
bildungsunderlebnis.haus
tradiematepro.com.au
parkstreetauto.net
eadsmurraypugh.com
physiofischer.de
sandd.nl
seagatesthreecharters.com
fax-payday-loans.com
friendsandbrgrs.com
evergreen-fishing.com
blgr.be
saka.gr
mariposapropaneaz.com
freie-gewerkschaften.de
appsformacpc.com
gasbarre.com
jvanvlietdichter.nl
binder-buerotechnik.at
urclan.net
dushka.ua
hoteledenpadova.it
dareckleyministries.com
irinaverwer.com
vibethink.net
pickanose.com
mepavex.nl
shiftinspiration.com
croftprecision.co.uk
amylendscrestview.com
pmc-services.de
servicegsm.net
exenberger.at
retroearthstudio.com
tanciu.com
mank.de
bxdf.info
hellohope.com
spargel-kochen.de
serce.info.pl
jacquin-maquettes.com
coastalbridgeadvisors.com
live-con-arte.de
foretprivee.ca
cleliaekiko.online
limassoldriving.com
cirugiauretra.es
datacenters-in-europe.com
bafuncs.org
blog.solutionsarchitect.guru
muamuadolls.com
coffreo.biz
biortaggivaldelsa.com
comparatif-lave-linge.fr
centromarysalud.com
daklesa.de
babcockchurch.org
krcove-zily.eu
botanicinnovations.com
geisterradler.de
streamerzradio1.site
loprus.pl
mymoneyforex.com
kingfamily.construction
licor43.de
courteney-cox.net
vetapharma.fr
fitnessbazaar.com
fairfriends18.de
drnice.de
d1franchise.com
joyeriaorindia.com
igfap.com
geoffreymeuli.com
ulyssemarketing.com
boldcitydowntown.com
tuuliautio.fi
maasreusel.nl
jasonbaileystudio.com
nataschawessels.com
better.town
maratonaclubedeportugal.com
firstpaymentservices.com
ncid.bc.ca
ecoledansemulhouse.fr
irishmachineryauctions.com
mirjamholleman.nl
gymnasedumanagement.com
apprendrelaudit.com
iphoneszervizbudapest.hu
rehabilitationcentersinhouston.net
hokagestore.com
reddysbakery.com
hvccfloorcare.com
leeuwardenstudentcity.nl
globedivers.wordpress.com
midmohandyman.com
testcoreprohealthuk.com
austinlchurch.com
baylegacy.com
waywithwords.net
saarland-thermen-resort.com
ausbeverage.com.au
izzi360.com
upplandsspar.se
baumkuchenexpo.jp
thedad.com
ralister.co.uk
operaslovakia.sk
desert-trails.com
corendonhotels.com
lapinlviasennus.fi
dontpassthepepper.com
pay4essays.net
charlottepoudroux-photographie.fr
spacecitysisters.org
testzandbakmetmening.online
calabasasdigest.com
herbayupro.com
zenderthelender.com
socstrp.org
coursio.com
dsl-ip.de
lebellevue.fr
delawarecorporatelaw.com
heurigen-bauer.at
mrxermon.de
journeybacktolife.com
vitavia.lt
35-40konkatsu.net
seminoc.com
365questions.org
sporthamper.com
global-kids.info
kosterra.com
verifort-capital.de
onlyresultsmarketing.com
apolomarcas.com
www1.proresult.no
clos-galant.com
lapinvihreat.fi
ostheimer.at
innote.fi
psa-sec.de
crosspointefellowship.church
y-archive.com
rollingrockcolumbia.com
eco-southafrica.com
sarbatkhalsafoundation.org
twohourswithlena.wordpress.com
karacaoglu.nl
kaminscy.com
interactcenter.org
plastidip.com.ar
fotoscondron.com
wien-mitte.co.at
stoneys.ch
koken-voor-baby.nl
imperfectstore.com
bimnapratica.com
fatfreezingmachines.com
lecantou-coworking.com
otsu-bon.com
accountancywijchen.nl
behavioralmedicinespecialists.com
allfortheloveofyou.com
4youbeautysalon.com
mastertechengineering.com
stingraybeach.com
elimchan.com
brigitte-erler.com
corelifenutrition.com
xn--thucmctc-13a1357egba.com
mrtour.site
creative-waves.co.uk
otto-bollmann.de
denovofoodsgroup.com
slimani.net
hashkasolutindo.com
kikedeoliveira.com
body-guards.it
liveottelut.com
jusibe.com
deltacleta.cat
quemargrasa.net
travelffeine.com
hhcourier.com
ki-lowroermond.nl
jeanlouissibomana.com
hkr-reise.de
myteamgenius.com
minipara.com
tinkoff-mobayl.ru
victoriousfestival.co.uk
tophumanservicescourses.com
kenhnoithatgo.com
officehymy.com
castillobalduz.es
erstatningsadvokaterne.dk
puertamatic.es
vorotauu.ru
oceanastudios.com
solhaug.tk
qlog.de
maryloutaylor.com
dutchbrewingcoffee.com
promesapuertorico.com
love30-chanko.com
dubnew.com
nsec.se
offroadbeasts.com
devlaur.com
devok.info
vannesteconstruct.be
corona-handles.com
humanityplus.org
tandartspraktijkhartjegroningen.nl
katketytaanet.fi
wychowanieprzedszkolne.pl
tarotdeseidel.com
kindersitze-vergleich.de
dw-css.de
financescorecard.com
todocaracoles.com
atmos-show.com
rerekatu.com
planchaavapor.net
echtveilig.nl
siluet-decor.ru
bhwlawfirm.com
centrospgolega.com
withahmed.com
danholzmann.com
executiveairllc.com
hairstylesnow.site
commonground-stories.com
solinegraphic.com
abogadoengijon.es
craigvalentineacademy.com
zimmerei-deboer.de
personalenhancementcenter.com
wmiadmin.com
smalltownideamill.wordpress.com
christ-michael.net
lukeshepley.wordpress.com
yousay.site
trulynolen.co.uk
lescomtesdemean.be
rocketccw.com
smart-light.co.uk
edv-live.de
profectis.de
deprobatehelp.com
esope-formation.fr
mmgdouai.fr
igorbarbosa.com
collaborativeclassroom.org
ecopro-kanto.com
aminaboutique247.com
corola.es
connectedace.com
jyzdesign.com
werkkring.nl
haar-spange.com
uimaan.fi
xlarge.at
blood-sports.net
tonelektro.nl
rebeccarisher.com
aakritpatel.com
roygolden.com
ikads.org
boulderwelt-muenchen-west.de
schmalhorst.de
gw2guilds.org
galleryartfair.com
noixdecocom.fr
stemenstilte.nl
braffinjurylawfirm.com
people-biz.com
x-ray.ca
iwr.nl
cuspdental.com
freie-baugutachterpraxis.de
crowcanyon.com
insidegarage.pl
berliner-versicherungsvergleich.de
podsosnami.ru
selfoutlet.com
suncrestcabinets.ca
jakekozmor.com
carlosja.com
sipstroysochi.ru
allamatberedare.se
despedidascostablanca.es
agence-chocolat-noir.com
id-et-d.fr
strandcampingdoonbeg.com
zieglerbrothers.de
smessier.com
kevinjodea.com
makeitcount.at
8449nohate.org
homesdollar.com
ino-professional.ru
abogadosadomicilio.es
101gowrie.com
euro-trend.pl
id-vet.com
aniblinova.wordpress.com
div-vertriebsforschung.de
bauertree.com
123vrachi.ru
argenblogs.com.ar
marketingsulweb.com
completeweddingkansas.com
boisehosting.net
ccpbroadband.com
verytycs.com
modestmanagement.com
iqbalscientific.com
mrsplans.net
d2marketing.co.uk
tips.technology
danubecloud.com
airconditioning-waalwijk.nl
xn--logopdie-leverkusen-kwb.de
basisschooldezonnewijzer.nl
homecomingstudio.com
liikelataamo.fi
higadograsoweb.com
boompinoy.com
digivod.de
kafu.ch
lusak.at
modelmaking.nl
kostenlose-webcams.com
new.devon.gov.uk
importardechina.info
ausair.com.au
hotelsolbh.com.br
walter-lemm.de
beaconhealthsystem.org
1team.es
unetica.fr
allentownpapershow.com
nakupunafoundation.org
parkcf.nl
elpa.se
triggi.de
thee.network
ianaswanson.com
macabaneaupaysflechois.com
homng.net
lynsayshepherd.co.uk
xn--fnsterputssollentuna-39b.se
mediaplayertest.net
perbudget.com
rhinosfootballacademy.com
abogadosaccidentetraficosevilla.es
team-montage.dk
sterlingessay.com
joseconstela.com
bigbaguettes.eu
caribdoctor.org
katiekerr.co.uk
edrcreditservices.nl
slwgs.org
ledmes.ru
gratispresent.se
pmcimpact.com
xn--singlebrsen-vergleich-nec.com
pv-design.de
healthyyworkout.com
stormwall.se
bristolaeroclub.co.uk
filmstreamingvfcomplet.be
latribuessentielle.com
fizzl.ru
theshungiteexperience.com.au
siliconbeach-realestate.com
hexcreatives.co
liliesandbeauties.org
markelbroch.com
revezlimage.com
bayoga.co.uk
sahalstore.com
amerikansktgodis.se
jsfg.com
deepsouthclothingcompany.com
asteriag.com
crowd-patch.co.uk
dekkinngay.com
consultaractadenacimiento.com
theclubms.com
milanonotai.it
maineemploymentlawyerblog.com
hrabritelefon.hr
lichencafe.com
mardenherefordshire-pc.gov.uk
pointos.com
autofolierung-lu.de
qualitaetstag.de
ymca-cw.org.uk
stupbratt.no
celeclub.org
mylolis.com
antiaginghealthbenefits.com
webcodingstudio.com
femxarxa.cat
edgewoodestates.org
theadventureedge.com
syndikat-asphaltfieber.de
lascuola.nl
smithmediastrategies.com
groupe-cets.com
dirittosanitario.biz
dutchcoder.nl
tongdaifpthaiphong.net
ussmontanacommittee.us
ventti.com.ar
destinationclients.fr
simpkinsedwards.co.uk
richard-felix.co.uk
delchacay.com.ar
bricotienda.com
nijaplay.com
stoeferlehalle.de
systemate.dk
deko4you.at
architekturbuero-wagner.net
bockamp.com
cheminpsy.fr
associacioesportivapolitg.cat
bouldercafe-wuppertal.de
alysonhoward.com
intecwi.com
grelot-home.com
readberserk.com
pasivect.co.uk
slashdb.com
klimt2012.info
vox-surveys.com
labobit.it
bargningavesta.se
tennisclubetten.nl
hmsdanmark.dk
aurum-juweliere.de
lightair.com
proudground.org
chaotrang.com
naturavetal.hr
autodemontagenijmegen.nl
vyhino-zhulebino-24.ru
paulisdogshop.de
ihr-news.jp
adultgamezone.com
spsshomeworkhelp.com
levdittliv.se
vihannesporssi.fi
shhealthlaw.com
tsklogistik.eu
bradynursery.com
cwsitservices.co.uk
augenta.com
huissier-creteil.com
gmto.fr
cimanchesterescorts.co.uk
pubweb.carnet.hr
linnankellari.fi
huehnerauge-entfernen.de
bee4win.com
anybookreader.de
promalaga.es
bouncingbonanza.com
thailandholic.com
harveybp.com
fayrecreations.com
surespark.org.uk
zimmerei-fl.de
marchand-sloboda.com
odiclinic.org
rafaut.com
nestor-swiss.ch
synlab.lt
poultrypartners.nl
argos.wityu.fund
artige.com
dezatec.es
backstreetpub.com
patrickfoundation.net
meusharklinithome.wordpress.com
shiresresidential.com
tinyagency.com
mooreslawngarden.com
blossombeyond50.com
restaurantesszimmer.de
ilso.net
trapiantofue.it
bordercollie-nim.nl
idemblogs.com
malychanieruchomoscipremium.com
galserwis.pl
tanzprojekt.com
lucidinvestbank.com
tampaallen.com
gporf.fr
waveneyrivercentre.co.uk
onlybacklink.com
ouryoungminds.wordpress.com
torgbodenbollnas.se
bastutunnan.se
vesinhnha.com.vn
mapawood.com
microcirc.net
bundabergeyeclinic.com.au
dramagickcom.wordpress.com
woodleyacademy.org
herbstfeststaefa.ch
makeflowers.ru
deschl.net
lachofikschiet.nl
oncarrot.com
videomarketing.pro
winrace.no
polychromelabs.com
kampotpepper.gives
coding-machine.com
thefixhut.com
abitur-undwieweiter.de
kao.at
chefdays.de
stopilhan.com
1kbk.com.ua
paradicepacks.com
madinblack.com
monark.com
quickyfunds.com
ladelirante.fr
klusbeter.nl
jobmap.at
montrium.com
sojamindbody.com
ogdenvision.com
cafemattmeera.com
manijaipur.com
mindpackstudios.com
dpo-as-a-service.com
seitzdruck.com
yourobgyn.net
darnallwellbeing.org.uk
vickiegrayimages.com
mbfagency.com
thaysa.com
csgospeltips.se
comarenterprises.com
triactis.com
arteservicefabbro.com
cursoporcelanatoliquido.online
blewback.com
fitovitaforum.com
merzi.info
pinkexcel.com
eaglemeetstiger.de
cranleighscoutgroup.org
mirkoreisser.de
vdberg-autoimport.nl
danskretursystem.dk
sw1m.ru
figura.team
launchhubl.com
nuzech.com
digi-talents.com
jerling.de
work2live.de
rota-installations.co.uk
actecfoundation.org
carriagehousesalonvt.com
mountaintoptinyhomes.com
platformier.com
imaginado.de
candyhouseusa.com
dlc.berlin
blogdecachorros.com
peterstrobos.com
aselbermachen.com
cerebralforce.net
ligiercenter-sachsen.de
ditog.fr
waynela.com
ilive.lt
embracinghiscall.com
hugoversichert.de
manifestinglab.com
drugdevice.org
ra-staudte.de
takeflat.com
bookspeopleplaces.com
wasmachtmeinfonds.at
wacochamber.com
chandlerpd.com
crediacces.com
fitnessingbyjessica.com
stefanpasch.me
stampagrafica.es
xn--rumung-bua.online
facettenreich27.de
atozdistribution.co.uk
quizzingbee.com
vanswigchemdesign.com
jadwalbolanet.info
micro-automation.de
romeguidedvisit.com
evologic-technologies.com
spinheal.ru
insigniapmg.com
spylista.com
autodujos.lt
ateliergamila.com
almosthomedogrescue.dog
oldschoolfun.net
alhashem.net
theletter.company
pivoineetc.fr
xn--fn-kka.no
qualitus.com
polzine.net
ivfminiua.com
xltyu.com
webhostingsrbija.rs
simulatebrain.com
sofavietxinh.com
rushhourappliances.com
sla-paris.com
answerstest.ru
makeurvoiceheard.com
chavesdoareeiro.com
stoeberstuuv.de
tanzschule-kieber.de
notmissingout.com
igrealestate.com
nancy-informatique.fr
rumahminangberdaya.com
garage-lecompte-rouen.fr
mir-na-iznanku.com
birnam-wood.com
colorofhorses.com
lloydconstruction.com
cnoia.org
roadwarrior.app
urmasiimariiuniri.ro
itelagen.com
balticdentists.com
cursosgratuitosnainternet.com
modamilyon.com
pelorus.group
jobcenterkenya.com
parebrise-tla.fr
heidelbergartstudio.gallery
ivivo.es
lapmangfpt.info.vn
berlin-bamboo-bikes.org
artotelamsterdam.com
greenko.pl
danielblum.info
projetlyonturin.fr
tastewilliamsburg.com
securityfmm.com
toreria.es
sauschneider.info
wsoil.com.sg
centuryrs.com
purposeadvisorsolutions.com
tenacitytenfold.com
architecturalfiberglass.org
plotlinecreative.com
citymax-cr.com
vitalyscenter.es
myhostcloud.com
easytrans.com.au
simoneblum.de
drinkseed.com
greenfieldoptimaldentalcare.com
heliomotion.com
pixelarttees.com
bogdanpeptine.ro
beyondmarcomdotcom.wordpress.com
chatizel-paysage.fr
the-virtualizer.com
kunze-immobilien.de
creamery201.com
advizewealth.com
brevitempore.net
expandet.dk
blacksirius.de
humancondition.com
pcp-nc.com
art2gointerieurprojecten.nl
grupocarvalhoerodrigues.com.br
toponlinecasinosuk.co.uk
c-a.co.in
filmvideoweb.com
teresianmedia.org
gemeentehetkompas.nl
smartypractice.com
fannmedias.com
wurmpower.at
summitmarketingstrategies.com
4net.guru
ilcdover.com
dubscollective.com
xoabigail.com
pcprofessor.com
321play.com.hk
iviaggisonciliegie.it
maureenbreezedancetheater.org
shsthepapercut.com
nvwoodwerks.com
bowengroup.com.au
bigler-hrconsulting.ch
web.ion.ag
assurancesalextrespaille.fr
unim.su
upmrkt.co
bptdmaluku.com
antonmack.de
icpcnj.org
buroludo.nl
sabel-bf.com
schraven.de
parks-nuernberg.de
jorgobe.at
brawnmediany.com
rieed.de
handi-jack-llc.com
asgestion.com
campus2day.de
controldekk.com
rksbusiness.com
longislandelderlaw.com
associationanalytics.com
n1-headache.com
teczowadolina.bytom.pl
jbbjw.com
huesges-gruppe.de
happyeasterimages.org
vibehouse.rw
alten-mebel63.ru
wari.com.pe
funjose.org.gt
smokeysstoves.com
dinslips.se
12starhd.online
moveonnews.com
penco.ie
c2e-poitiers.com
mercantedifiori.com
christinarebuffetcourses.com
musictreehouse.net
teknoz.net
portoesdofarrobo.com
sagadc.com
leather-factory.co.jp
denifl-consulting.at
hushavefritid.dk
kidbucketlist.com.au
lubetkinmediacompanies.com
notsilentmd.org
sevenadvertising.com
hardinggroup.com
kojima-shihou.com
kalkulator-oszczednosci.pl
aco-media.nl
phantastyk.com
nachhilfe-unterricht.com
zzyjtsgls.com
praxis-foerderdiagnostik.de
westdeptfordbuyrite.com
em-gmbh.ch
balticdermatology.lt
villa-marrakesch.de
veybachcenter.de
latestmodsapks.com
falcou.fr
pawsuppetlovers.com
allure-cosmetics.at
havecamerawilltravel2017.wordpress.com
entopic.com
abl1.net
ai-spt.jp
highlinesouthasc.com
employeesurveys.com
naswrrg.org
jameskibbie.com
mdk-mediadesign.de
oneplusresource.org
effortlesspromo.com
hihaho.com
aarvorg.com
urist-bogatyr.ru
conexa4papers.trade
truenyc.co
pogypneu.sk
troegs.com
ncs-graphic-studio.com
buymedical.biz
blumenhof-wegleitner.at
imadarchid.com
glennroberts.co.nz
henricekupper.com
body-armour.online
dnepr-beskid.com.ua
dr-seleznev.com
ftlc.es
evangelische-pfarrgemeinde-tuniberg.de
ziegler-praezisionsteile.de
baptisttabernacle.com
girlillamarketing.com
luxurytv.jp
agence-referencement-naturel-geneve.net
mytechnoway.com
ora-it.de
smale-opticiens.nl
mbxvii.com
bunburyfreightservices.com.au
2ekeus.nl
darrenkeslerministries.com
biapi-coaching.fr
yassir.pro
lange.host
kamienny-dywan24.pl
adoptioperheet.fi
nosuchthingasgovernment.com
you-bysia.com.au
kojinsaisei.info
alfa-stroy72.com
justinvieira.com
lorenacarnero.com
raschlosser.de
partnertaxi.sk
anthonystreetrimming.com
plantag.de
bigasgrup.com
pier40forall.org
trackyourconstruction.com
kamahouse.net
broseller.com
shonacox.com
songunceliptv.com
kisplanning.com.au
myzk.site
campusoutreach.org
anteniti.com
hypozentrum.com
mooshine.com
cyntox.com
run4study.com
narcert.com
southeasternacademyofprosthodontics.org
softsproductkey.com
dr-tremel-rednitzhembach.de
sobreholanda.com
devstyle.org
insp.bi
hebkft.hu
norpol-yachting.com
juneauopioidworkgroup.org
finde-deine-marke.de
hairnetty.wordpress.com
nativeformulas.com
norovirus-ratgeber.de
thedresserie.com
oneheartwarriors.at
wolf-glas-und-kunst.de
milltimber.aberdeen.sch.uk
skiltogprint.no
socialonemedia.com
micahkoleoso.de
resortmtn.com
psnacademy.in
aprepol.com
littlebird.salon
nmiec.com
aodaichandung.com
drfoyle.com
nurturingwisdom.com
rostoncastings.co.uk
atalent.fi
beautychance.se
schutting-info.nl
wraithco.com
houseofplus.com
carolinepenn.com
theduke.de
pridoxmaterieel.nl
morawe-krueger.de
zewatchers.com
milestoneshows.com
sportverein-tambach.de
visiativ-industry.fr
lykkeliv.net
sloverse.com
theapifactory.com
olejack.ru
lbcframingelectrical.com
besttechie.com
trystana.com
fundaciongregal.org
seevilla-dr-sturm.at
international-sound-awards.com
ontrailsandboulevards.com
rosavalamedahr.com
lefumetdesdombes.com
memaag.com
autopfand24.de
dr-pipi.de
oslomf.no
deoudedorpskernnoordwijk.nl
xtptrack.com
tomoiyuma.com
marietteaernoudts.nl
polymedia.dk
wellplast.se
sairaku.net
sportiomsportfondsen.nl
craigmccabe.fun
nhadatcanho247.com
luckypatcher-apkz.com
classycurtainsltd.co.uk
ceid.info.tr
mountsoul.de
seproc.hn
cityorchardhtx.com
forestlakeuca.org.au
radaradvies.nl
tetinfo.in
turkcaparbariatrics.com
talentwunder.com
presseclub-magdeburg.de
precisionbevel.com
cuppacap.com
fensterbau-ziegler.de
fransespiegels.nl
simpliza.com
satyayoga.de
kuntokeskusrok.fi
epwritescom.wordpress.com
naturstein-hotte.de
nandistribution.nl
zso-mannheim.de
tux-espacios.com
noesis.tech
pomodori-pizzeria.de
kirkepartner.dk
naturalrapids.com
fibrofolliculoma.info
pierrehale.com
pasvenska.se
samnewbyjax.com
marcuswhitten.site
plv.media
transportesycementoshidalgo.es
johnsonfamilyfarmblog.wordpress.com
commercialboatbuilding.com
directwindowco.com
ncuccr.org
lmtprovisions.com
charlesreger.com
bingonearme.org
tomaso.gr
outcomeisincome.com
starsarecircular.org
vermoote.de
gantungankunciakrilikbandung.com
admos-gleitlager.de
americafirstcommittee.org
edelman.jp
faroairporttransfers.net
DupontSellsHomes.com
baronloan.org
tandartspraktijkheesch.nl
waermetauscher-berechnen.de
kaotikkustomz.com
aglend.com.au
parking.netgateway.eu
smogathon.com
smejump.co.th
goodgirlrecovery.com
sotsioloogia.ee
tulsawaterheaterinstallation.com
symphonyenvironmental.com
shadebarandgrillorlando.com
highimpactoutdoors.net
thomas-hospital.de
opatrovanie-ako.sk
artallnightdc.com
all-turtles.com
skanah.com
supportsumba.nl
knowledgemuseumbd.com
helikoptervluchtnewyork.nl
lenreactiv-shop.ru
calxplus.eu
abuelos.com
senson.fi
mikeramirezcpa.com
i-arslan.de
iyengaryogacharlotte.com
kissit.ca
copystar.co.uk
gamesboard.info
boosthybrid.com.au
first-2-aid-u.com
ravensnesthomegoods.com
asiluxury.com
gonzalezfornes.es
smhydro.com.pl
sportsmassoren.com
kmbshipping.co.uk
webmaster-peloton.com
schoolofpassivewealth.com
sexandfessenjoon.wordpress.com
tigsltd.com
educar.org
gastsicht.de
familypark40.com
ohidesign.com
kariokids.com
simplyblessedbykeepingitreal.com
ecpmedia.vn
bargningharnosand.se
nokesvilledentistry.com
aunexis.ch
spd-ehningen.de
baustb.de
diversiapsicologia.es
sinal.org
porno-gringo.com
zonamovie21.net
strategicstatements.com
xn--vrftet-pua.biz
pocket-opera.de
cite4me.org
gaiam.nl
spectrmash.ru
farhaani.com
stacyloeb.com
zervicethai.co.th
pferdebiester.de
alsace-first.com
haremnick.com
stemplusacademy.com
instatron.net
psc.de
slupetzky.at
milsing.hr
navyfederalautooverseas.com
jandaonline.com
piajeppesen.dk
woodworkersolution.com
durganews.com
mrsfieldskc.com
ampisolabergeggi.it
mediaclan.info
kedak.de
geekwork.pl
bouquet-de-roses.com
panelsandwichmadrid.es
i-trust.dk
abogados-en-alicante.es
real-estate-experts.com
levihotelspa.fi
steampluscarpetandfloors.com
sanyue119.com
space.ua
slimidealherbal.com
ahouseforlease.com
chrissieperry.com
celularity.com
degroenetunnel.com
mdacares.com
oemands.dk
krlosdavid.com
newstap.com.ng
sweering.fr
layrshift.eu
-
net
true
-
pid
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
-
prc
firefox
mydesktopservice
xfssvccon
infopath
visio
encsvc
onenote
ocssd
ocautoupds
excel
agntsvc
outlook
mspub
iconcerto
wordpad
sqbcoreservice
winword
oracle
thunderbird
ocomm
mydesktopqos
steam
dbsnmp
sql
synctime
tbirdconfig
dbeng50
isqlplussvc
msaccess
thebat
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7595
-
svc
memtas
veeam
sophos
sql
vss
svc$
mepocs
backup
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
Executes dropped EXE 1 IoCs
Processes:
MsMpEng.exepid process 4040 MsMpEng.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
MsMpEng.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\EnableUnblock.tiff MsMpEng.exe File renamed C:\Users\Admin\Pictures\EnableUnblock.tiff => \??\c:\users\admin\pictures\EnableUnblock.tiff.636zy6 MsMpEng.exe File renamed C:\Users\Admin\Pictures\LimitInstall.raw => \??\c:\users\admin\pictures\LimitInstall.raw.636zy6 MsMpEng.exe File renamed C:\Users\Admin\Pictures\SyncUninstall.png => \??\c:\users\admin\pictures\SyncUninstall.png.636zy6 MsMpEng.exe File renamed C:\Users\Admin\Pictures\ConvertFromTest.raw => \??\c:\users\admin\pictures\ConvertFromTest.raw.636zy6 MsMpEng.exe File renamed C:\Users\Admin\Pictures\ConvertToGroup.png => \??\c:\users\admin\pictures\ConvertToGroup.png.636zy6 MsMpEng.exe File renamed C:\Users\Admin\Pictures\ConvertSkip.crw => \??\c:\users\admin\pictures\ConvertSkip.crw.636zy6 MsMpEng.exe -
Loads dropped DLL 1 IoCs
Processes:
MsMpEng.exepid process 4040 MsMpEng.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MsMpEng.exedescription ioc process File opened (read-only) \??\Y: MsMpEng.exe File opened (read-only) \??\D: MsMpEng.exe File opened (read-only) \??\J: MsMpEng.exe File opened (read-only) \??\K: MsMpEng.exe File opened (read-only) \??\L: MsMpEng.exe File opened (read-only) \??\W: MsMpEng.exe File opened (read-only) \??\Q: MsMpEng.exe File opened (read-only) \??\T: MsMpEng.exe File opened (read-only) \??\E: MsMpEng.exe File opened (read-only) \??\F: MsMpEng.exe File opened (read-only) \??\I: MsMpEng.exe File opened (read-only) \??\P: MsMpEng.exe File opened (read-only) \??\V: MsMpEng.exe File opened (read-only) \??\X: MsMpEng.exe File opened (read-only) \??\Z: MsMpEng.exe File opened (read-only) \??\A: MsMpEng.exe File opened (read-only) \??\G: MsMpEng.exe File opened (read-only) \??\N: MsMpEng.exe File opened (read-only) \??\R: MsMpEng.exe File opened (read-only) \??\S: MsMpEng.exe File opened (read-only) \??\U: MsMpEng.exe File opened (read-only) \??\B: MsMpEng.exe File opened (read-only) \??\H: MsMpEng.exe File opened (read-only) \??\M: MsMpEng.exe File opened (read-only) \??\O: MsMpEng.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
MsMpEng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zwcbsy9i3m9em.bmp" MsMpEng.exe -
Drops file in Program Files directory 17 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification \??\c:\program files\OptimizeMerge.jfif MsMpEng.exe File opened for modification \??\c:\program files\ResizePush.ADT MsMpEng.exe File opened for modification \??\c:\program files\SearchSubmit.png MsMpEng.exe File opened for modification \??\c:\program files\DenyBlock.mpg MsMpEng.exe File opened for modification \??\c:\program files\FormatConvert.mpv2 MsMpEng.exe File opened for modification \??\c:\program files\JoinSubmit.jpeg MsMpEng.exe File opened for modification \??\c:\program files\SkipRemove.dxf MsMpEng.exe File opened for modification \??\c:\program files\TestShow.mpg MsMpEng.exe File opened for modification \??\c:\program files\UndoExpand.emz MsMpEng.exe File created \??\c:\program files (x86)\636zy6-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\AddUndo.jtx MsMpEng.exe File created \??\c:\program files\636zy6-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\ConvertFromRestart.cfg MsMpEng.exe File opened for modification \??\c:\program files\DisconnectAdd.xml MsMpEng.exe File opened for modification \??\c:\program files\SubmitReceive.inf MsMpEng.exe File opened for modification \??\c:\program files\UninstallClose.png MsMpEng.exe File opened for modification \??\c:\program files\BlockEnable.mht MsMpEng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
MsMpEng.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 1900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6362000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f007400200058003100000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e309000000010000000c000000300a06082b06010505070301030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000000400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e809000000010000000c000000300a06082b060105050703011d000000010000001000000073b6876195f5d18e048510422aef04e314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0b000000010000001a0000004900530052004700200052006f006f007400200058003100000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 MsMpEng.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB MsMpEng.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 04000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5112000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 1900000001000000100000000790dd35d0de1a5516689a62748c58eb0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf04000000010000001000000074014a91b108c458ce47cdf0dd1153082000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6362000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f007400200058003100000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e309000000010000000c000000300a06082b06010505070301030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e820000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e809000000010000000c000000300a06082b060105050703011d000000010000001000000073b6876195f5d18e048510422aef04e314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0b000000010000001a0000004900530052004700200052006f006f007400200058003100000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6320000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 MsMpEng.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 5c00000001000000040000000008000004000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5111900000001000000100000000790dd35d0de1a5516689a62748c58eb2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 MsMpEng.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
MsMpEng.exepid process 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe 4040 MsMpEng.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
MsMpEng.exevssvc.exedescription pid process Token: SeDebugPrivilege 4040 MsMpEng.exe Token: SeTakeOwnershipPrivilege 4040 MsMpEng.exe Token: SeBackupPrivilege 2724 vssvc.exe Token: SeRestorePrivilege 2724 vssvc.exe Token: SeAuditPrivilege 2724 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.execmd.exedescription pid process target process PID 3996 wrote to memory of 4024 3996 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 3996 wrote to memory of 4024 3996 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 3996 wrote to memory of 4024 3996 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 4024 wrote to memory of 4040 4024 cmd.exe MsMpEng.exe PID 4024 wrote to memory of 4040 4024 cmd.exe MsMpEng.exe PID 4024 wrote to memory of 4040 4024 cmd.exe MsMpEng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeC:\Users\Admin\AppData\Local\Temp\MsMpEng.exe3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:740
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\mpsvc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
\Users\Admin\AppData\Local\Temp\MpsVc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
memory/4024-115-0x0000000000000000-mapping.dmp
-
memory/4040-116-0x0000000000000000-mapping.dmp
-
memory/4040-121-0x0000000000D40000-0x0000000000D61000-memory.dmpFilesize
132KB