Malware Analysis Report

2024-11-30 11:44

Sample ID 240225-mvag1aaf8v
Target 240224-2cs9qagf6v_pw_infected.zip
SHA256 e51155ce803bd9b96b91c822e41969c89e0c9e162aebc7643c23ed9489eb75b4
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e51155ce803bd9b96b91c822e41969c89e0c9e162aebc7643c23ed9489eb75b4

Threat Level: Known bad

The file 240224-2cs9qagf6v_pw_infected.zip was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (10119) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-25 10:46

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-25 10:46

Reported

2024-02-25 10:51

Platform

win11-20240221-en

Max time kernel

282s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe"

Signatures

Renames multiple (10119) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\74AF.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\74AF.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2930051783-2551506282-3430162621-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2930051783-2551506282-3430162621-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPwudu_c1_n2_4bmrtmm7a2y75.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP6s71q_sqc554irrvn92rs106.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPgzr_ufcskqmsm72xn_gf3dhjb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\8O1xgE2fH.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\8O1xgE2fH.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\74AF.tmp N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubSplashScreen.scale-100_altform-colorful.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.ps1 C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Match.Tests.ps1.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSplashScreen.scale-400.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-48_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.ini.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\LICENSE C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\move.svg.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\ReachFramework.resources.dll.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-150.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\nl-NL\PAD.Console.Host.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\IACOM2.DLL.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\no_get.svg C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Globalization.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Breadcrumb\Breadcrumb.base.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleBadgeLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\PhotosApp\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\AppxMetadata\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.8O1xgE2fH C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\8O1xgE2fH.README.txt C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\CLIENT.CBS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\TOTAL C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\CLIENT.CBS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "1" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\Total = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\Total = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\NumberOfSubdomains = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\WWW.BING.COM C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5800 wrote to memory of 6676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 6676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 8096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 9860 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 9860 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5800 wrote to memory of 5516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_4fb4a10158fe5415e8e9468ec2d0dbbc_darkside.exe"

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff83b503cb8,0x7ff83b503cc8,0x7ff83b503cd8

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,14410593600392012843,10223447708207935417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1B4E76B8-88EF-4D56-BD2F-B538151E895B}.xps" 133533316566230000

C:\ProgramData\74AF.tmp

"C:\ProgramData\74AF.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\74AF.tmp >> NUL

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp

Files

memory/2548-0-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/2548-1-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/2548-2-0x0000000002C80000-0x0000000002C90000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2930051783-2551506282-3430162621-1000\desktop.ini

MD5 6a4fdcc85c69024b93b57cf0202e9199
SHA1 0aaca49a2ad8a86660d37982a7337011c25bd932
SHA256 eb0b4cd7aafa0ee4d58b6668d9eb002967205767e0e9bcccf8bd94fa8c8f7768
SHA512 04ce3100ec8a48457066b9a0e30a7f6d3b9d0aaf199328a931ff80e723c73218275a1b608b0581d814710e7ddeda2f9b5e094fb9318c108575ff5399d0b1caa4

F:\$RECYCLE.BIN\S-1-5-21-2930051783-2551506282-3430162621-1000\DDDDDDDDDDD

MD5 96c225db48d3b82f780860f100091619
SHA1 bfe4811ceefbb78fcd42385084957979266e477c
SHA256 074784c90a9838ee8cb0b9f5640efc217b5168b35d090270dd1623f70bd7302e
SHA512 d095466312ca13c38d438764ed2508e6d45b9e96b613828a22e4f900ce409826803e846c96d5325813760588f698de2459078e2965f1a2746f40293d0beb9e22

C:\8O1xgE2fH.README.txt

MD5 03776d7fc884e7dac5501b18d24f354d
SHA1 bbcb2720d5059e47a6e7cf46fb157ca52cb27ec5
SHA256 441749090d1947fcd5ab715fee81be6e809f0d2d0b15430d119365f28c906e1c
SHA512 bc74a203946de88318f018ef00735041e12902e0f7547c24fdd09b7509ad22f8de233e91e514f7da49eebfcac1f3c86361c87337f19e0d29f4e945d1dcff05ef

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

MD5 46ee27bf2ef5da046f52052635557f6d
SHA1 bbf76cbb88549be1c374a47913c8bb565af15700
SHA256 c790a0d857602bc601c1a373a5fe0674ac3613fd43eb2810ffe18b83a5d32d30
SHA512 3d87b258d138ebf69e01aeb5aa57613f5dad0e4f2cdffdd59a9727330de465b0fb0a8ce38716959218ed31dbd31b7f0536d27cfe79712c2ed336c5343c4519bb

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

MD5 bb89d20aee84f28d13cacb69bf7c4342
SHA1 dca335df387345acb550fe666e92ca923a858947
SHA256 9f3f97144025749e9687a9d923d79be0433da9b00504a1c5b7616538baddeabc
SHA512 84b0cba2b8a3244899fa719ba24e317e16de19ea01bb6ebe4610282e648fa57443c1b37b3e9f5c786aa8bf44be5e67537023b59ea8edb57fe1873c2c87667b28

memory/2888-9443-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-10043-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11227-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

C:\Users\Admin\Desktop\WatchInstall.rle.8O1xgE2fH

MD5 540eb8cb2cbdb2658d144307e19fc63b
SHA1 a41473625ad7c53e3bd1c45b6f5f95b7cf62424e
SHA256 c41f36dc8bdfb8ceb2a7bbd76c20d6cbf83b1be49a7a384fef168356795fee33
SHA512 2e60a2c2f24f942d488970d373a474ca69362b24901be09834d14200a5dd4bd0f86ea2245ed3301f5dc64c539d77f8dbd74d6f4b3d376254479e24817a3c01b6

C:\Users\Admin\Desktop\UnlockStart.au3.8O1xgE2fH

MD5 bcabbfeeda4412e2a0e2fc31485f7fa9
SHA1 54e90561bb85d5446f8207ddd255569d017f009b
SHA256 e59fc2230bf05ed99e9eb865790b8ae66fd04a12d69389856738afd9459e42c4
SHA512 cf66d9511c0892d026a0f4e3ed1de418960a0af589176e7091e9958130a41b5806aea9e16cc7c596bea33484370c2a8987214ef59c7abe35c885e4c9a01fc8a7

C:\Users\Admin\Desktop\UnlockCompare.wmv.8O1xgE2fH

MD5 6ebce528a3108c3a60a19a4f442ab7b4
SHA1 9db1d2cbdae1e26460db378fddb2d4ce2c39b6e0
SHA256 efbddeb5108711639ea5f0440784a3c02492d691f24583be997f6898da39446e
SHA512 0168c1891aa66a9416e91e69b5a617bc66488f8aad9102200062669ed09203116d6d563b46a6eac0eace2d3fa35c9ff4180d77c7077ead35f66b471cbf449802

C:\Users\Admin\Desktop\ResumeReset.emf.8O1xgE2fH

MD5 fa2cd8c1a4b542237f5eede357b38e36
SHA1 64a52268f2f4384ae3d24f6f7fe48e70381e2310
SHA256 bae61f1739396f3eb657adc5b553318b3ee8b92c2cdcac9e32062b96c5f893eb
SHA512 fba98115164af2581afe2b27c63f38b4fd175313b6dd2f00bf66e7938b8c47feafba342d49b9f23c0fef874533d99048f992caf08f1962f027177cba6269d945

C:\Users\Admin\Desktop\ResumeGroup.xhtml.8O1xgE2fH

MD5 289eca96f75e985ee942c24656ced794
SHA1 51fb441fb5f606fb0c1317cbec800e64e54931cb
SHA256 4368ddda21badd5a0c138f080f47ccae0bdb9b429c9e0b1a24fb944c9b11c82f
SHA512 dc06475219f7d946b19c5fc054cc480f5046a7e03652f9bd791377dca7f4e22240386d3800f703d48a85298e4eb2f3cc385c9969509245393ac746f545248caa

memory/2888-11307-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11334-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

C:\Users\Admin\Desktop\ResizeProtect.dll.8O1xgE2fH

MD5 f93a5ce0e6715a19949de73dc03f48f7
SHA1 a4ea0d4a4dd22206530d47b1c997e09b1d590148
SHA256 1c07ffd9e06beca20c33af705b15d965712d89632d57f03d9fa79dd1785c036e
SHA512 d811d2891bf699e7abb82096c92033e7240461312da47287897ad74e610e75fc6905271ed59410b840a7db57e197466456efb79987d6584d7eab77d9d32fd476

C:\Users\Admin\Desktop\RequestDismount.xht.8O1xgE2fH

MD5 6f8087673e7caafd776b2f577ca0422f
SHA1 7d5907c66b28efd3dd02af3ebb3b57e210db6256
SHA256 3311380962ed1824c6ffa09971d735625176b9dd708ed57fbeb2e4e362232182
SHA512 48cc664e5c7c5f820df69e629293c5048fec11dfcedabef0f98a459b9d92e6baea3c814a36370eeb6fde5b2529dea7bccd272db0110386ad1f193ac7708d004b

memory/2888-11346-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11349-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11370-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11358-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

memory/2888-11376-0x00000260FB9F0000-0x00000260FB9F1000-memory.dmp

C:\Users\Admin\Desktop\RegisterDismount.m4a.8O1xgE2fH

MD5 2d37d30e6b4c22f0a435c55a3e626e3b
SHA1 c2884be6c743bf85ff4496bc0ef3f4c7911fbbb0
SHA256 1603ba14d6df67a2483c4bebadbd26cad493a534769b672f35aa682d9c7e336d
SHA512 e812ff3c191ed238468762a0d34a811f2cb0b7c70417939e1b56c9b30c4bbe0824624f76d53c22bf9f1142d28c323f194c980003f3eab55093b47f361cfd0b57

C:\Users\Admin\Desktop\PushEnable.avi.8O1xgE2fH

MD5 79d4eadcda2dea02308fed7838a2c71b
SHA1 367695330cd08de005c635a2651ad73982a4a5e1
SHA256 936c7425f3e938a73ef3c435c2c0dd67c0d06a59465e3985c06898b421497fc4
SHA512 cb631b5ac2964ffbc0c6bda2999f7de0333eee95af8f9a28c27606aad9cc5a1cac559200f7059069cc7812c61e51fe253ba742c517640ef276cece67b460993f

C:\Users\Admin\Desktop\PublishMove.vsdm.8O1xgE2fH

MD5 c9d1fac69fcc84142448c0b098343965
SHA1 8c0c2d95d93ccac520e612f723ffd809c8f8f741
SHA256 b04db7e9c7a859358d01e990ffc19786085fd561261418df1e989a068992d9ae
SHA512 7b3305122e74b34ab0d9ba8c75e8e274e14fd7e8df9f88757a37b300dcd770899e4ff761f9337c180534c917e5c9ed16cae90ca58ed46b108d4bd9981dbe00d0

C:\Users\Admin\Desktop\ProtectEnter.jpg.8O1xgE2fH

MD5 3e4cf8767bab80727e266a129ebb15a5
SHA1 0b1412a216abd38ab342139a925bc7a6ceff496c
SHA256 8ab932689679949156cb201ca8a99f06e7643a0b6aa355049acc189707545855
SHA512 f024659e928ffac9aa41f3ed502be4f4f4ccebbb5f369dbc677328615a93e97bf7be4aaec51dff2c46384d4a451ae93e7f7cfdc188a7e2309f37dd37302cfbbe

C:\Users\Admin\Desktop\ProtectDeny.tif.8O1xgE2fH

MD5 8cd152bc6cbe47b6fd6f9dcda06917ea
SHA1 7b05e3d261abe2fb2965dc6ad7f028a8ebfb78a7
SHA256 b6a95b2382e5393c29b6f01e721edd9dba7b5279afc2f11c84305ba21e3b951e
SHA512 c006adc35c58e2f2c8bc38351e78298af44f9b141f67b4894ea7be98ddcc399f10fcfba884c2df2dec579120c822a40f237094efd1b6abbc1438f7b273d49ac1

C:\Users\Admin\Desktop\PopDeny.tiff.8O1xgE2fH

MD5 d060f3871713d76620acc51a2a7799dd
SHA1 8dc8ac657bd3963174e0f3351de0fd61721eb011
SHA256 413e8a978d75383cc9fcbe33ca1e8d5ea70f4c59dd783cd5243eb35e4630a897
SHA512 49dd44f6a6e45afd3ccdc8d5ca25809915f3fca5c88f1ea23a81d7deaf6b016c65b33287fe5292506dad3b284ae9704c8ff5ba6b083cb1fb8db72d3407cb799c

C:\Users\Admin\Desktop\OptimizeRepair.3g2.8O1xgE2fH

MD5 8801a2051c9dac1950df51abae876374
SHA1 5f9efaa42fe7a259ea0ee15696c1160d7957defc
SHA256 863366f10afe660a252afb2408af220bea338b3e09b792e7040d81869a6779e1
SHA512 d38eaf4cbda20f686bb1117883872edfd040e589cc9124265325313013340aa66d065ff19bce31d4efe02b35a733acaf6f3b935e489c5d7496c4ca6ebda4afaf

C:\Users\Admin\Desktop\NewRestart.vsdx.8O1xgE2fH

MD5 37affb7ecf10bcdaba0056f4c17ec82a
SHA1 3ffdb381dab767781814f2d58a791341ea90d618
SHA256 6cb85cd4cf3c33dce1aed89664c5039763a574b976514f6431671665b7324daf
SHA512 4c6f55160ee6cd85d4164bbeaa981271ae8cac2ccedcabffbdd54e0583b4f041877a3c712461da9ecf0941e8a1f4b0aebf014731dc47de7d75310fbb7a8ebac5

C:\Users\Admin\Desktop\InvokeUnlock.gif.8O1xgE2fH

MD5 926975d528bdddd10971f21d5fcfb7e0
SHA1 e6ad89895ffa003e0244575b2f1f8475d02a3557
SHA256 eb43c81237ee3d8d2afd0789bc1572287f0189791f40b63e5918101e6307d479
SHA512 67386cf5dc7a91c06cdab24c065214379fb01755d1006273d8ba137e02d32e97e7887d65ef34ed4856a195413072d5b3c91534ef23ceab45b5ff36c316f0202a

C:\Users\Admin\Desktop\InvokeImport.mpp.8O1xgE2fH

MD5 a29310526d44789308ddd807abe70414
SHA1 77c10d68e3a7fb34c96862bf79b2c61f9671a828
SHA256 aee3962d1b192e38d277be52c5cd707ccbbed949808419d18715975a127269a9
SHA512 e6d5436a750725ee548522260def5f22c65efd2e204943305bd785fdf811d2f717cf79f38aaa88d08ac1b0065d10a41e1681e0d567ba703ab3fa22ba1764e20f

C:\Users\Admin\Desktop\InstallSubmit.wpl.8O1xgE2fH

MD5 717fc398a68d76ee36668555d1f11f68
SHA1 ffa13601acb8741f1d8b6299063e05ce1865800b
SHA256 300f9db29efdfae959273e03a1db93a3861163ccfe2ecd4ce4340bd0c718dc4f
SHA512 aeafb1564a9b7c298552ee60731339dec19c44e97185271f59b67d8a6dc412ef534d4c3371cb197e8894cf33cb783ac46f80b58285fce989151f53d6f2a67f62

C:\Users\Admin\Desktop\ImportSend.js.8O1xgE2fH

MD5 2c9dff1fb8c7c3b90913ff9fc893834d
SHA1 bac461562d9acc4e9420cb3019ee0323405a00c9
SHA256 6cc4e21c48e852332ccca5d3bed5e2f278f60fb87f20b9c5ee37ab6e506b69a2
SHA512 951bf389cbe74f9466b212b3b2487cd8533c91c29612da776e1e1dd9b04088851f1525d88c819390d1f14670509177375093bb4ca9caf04638fb984a4ee480d5

C:\Users\Admin\Desktop\GroupGrant.tiff.8O1xgE2fH

MD5 2509f52798a312bb33d558e9de1d62f4
SHA1 e5849b4aa8f17d51041bbb4b60bab46c3762f595
SHA256 6ffb726aca5605483004423b8f2e229c0eb10d429bc0a65a4a01cb080ee9b3be
SHA512 9fe9a49732f9fb015942fe86257bdaa5bff4a5ec85681611efeb1afe99185637f3c8710b7e759232ddbcd8d688cf73b867e210a84e375ab89ebe40c1396325f1

C:\Users\Admin\Desktop\ExpandConvertFrom.wdp.8O1xgE2fH

MD5 c53a4cb3e9c284cf938bd70b0531cfa3
SHA1 8f8bb9d33491c9b0dae2d35dd8650671ee37906c
SHA256 15eccf5f09ae270bb95b1686c1fd79a2ce99a45b11a2053d5236b1bbe27632a1
SHA512 a7f5801c5664d35ac8ca6647db0e69bd198f2bcd54dc4c013de6d7bd331862f9b123f599292b510fae6c647a7ccfa7be8c7c68fa7c287ec16cf86d04553afb97

C:\Users\Admin\Desktop\ExportRegister.sys

MD5 6587fdd07f1da1b4b9be573f17ffb530
SHA1 55efb7e8039d609ff0cd1b74a076d0d2d2d6c3a4
SHA256 2c64c2de7734f56d2b95035f47bcfdfb990512eca5cf97cf677585e0469ac393
SHA512 cb279ea3789f5b0a83b3478f21d4fe00ef9ddd05143f8703d551c5f5d957400736cbea323eacfd7d8492d8b6829ff897224dc20d18dadeec5a9693c028145efe

C:\Users\Admin\Desktop\ExitComplete.M2V.8O1xgE2fH

MD5 86023a60db107c4b640f19b7454a0a98
SHA1 0da76469d622cdf46045738d7e9836dc5501c60c
SHA256 5edb93637ad5daf6befbb43eddb97d59f32639bdff7d54667776b1d65210eb00
SHA512 03e1410209c598e480ed1cbbc7ec3541cce955d701c00d03610744f55e7a952d5cf75638425cf19272162a0447cec0440e3fe1ad2eac25869082cc13689f401f

C:\Users\Admin\Desktop\DisableCompress.au.8O1xgE2fH

MD5 605504155c5343c82b5d1d6802deda8e
SHA1 16a1fb8204adaa0acc2820ab40896c19a689c1a8
SHA256 0e4072e7f5cd2fce9d9bf594433c85b0e16bdbe0336f15f533e8788f631471b7
SHA512 a98f83c9aa7912275498fa34621e04a697da9f3ee1fbeebca1bdc61250e222509ff9b3aeb84b96ba6ea0f6695630cc6b40cfce203f48006e1a1ca5c6cb6c2129

C:\Users\Admin\Desktop\CompressPop.emf.8O1xgE2fH

MD5 df4c917a880fd3af3a7faaf4b8a57346
SHA1 2b5f61c988763b688fab96817e78dd41f320cacc
SHA256 9cdb84bab0438cb4f31ed3ed0318e3fe8e5b3bd10a81c86dea7138e5b4cee05e
SHA512 e9f85ea4e303bb41db5bdc53f9abe28388da60abf6a4a0b117449466e7232b24ea6ab5ae52a67885ebe7d9f076a32b1b9210d230a51500f9f0a60d1f9e19c3cd

C:\Users\Admin\Desktop\ConnectMove.exe

MD5 9eee19be9bff4cfb5c2643d75725ee57
SHA1 5777b93ffe28c0e8285dbe3225b9ed77c6aab529
SHA256 d7d2b09f1e326ae8ee2ff596a9c040e23884cdd0704ac139cb3592e99450645b
SHA512 6ac57fd4d8bb39536954126a9c0dbc1bf337a6f7752911e59b4bff311c99faab7271e839c91c2ab025469b3da59fcfe109e6531945b0bcd10f98594628d00607

C:\Users\Admin\Desktop\AssertSend.easmx.8O1xgE2fH

MD5 10830f80f6961b89ba7fa6a08478c3d5
SHA1 045be4a8a021bab6014bcece3e9648d8c00d9102
SHA256 8bcbe7bc51b92c9fe979d3a975a6f28493d47e0ad9e88caa5aeb71048e4cde0f
SHA512 f9fa38f6610d032425745ff7e5f755fbdff4c839b51a03bf53344c2f46fa5444257ae0d534550a407fd8fde23ffd98a9a5e28aae9f4e704fa0a83ac483d9d516

C:\Users\Admin\Desktop\ApproveRevoke.M2TS.8O1xgE2fH

MD5 1201191faae4911f10d968556fd09c3e
SHA1 e9d21b7c689405aa369d9aa2652192ab2202e861
SHA256 db861c46128330776ff64a3e7311e54cf6b50ec6098fbd4e5a742bb972aa5933
SHA512 b3e4b723f5ba942e5a32301b22a0d3d4d545b148af6f3c1690ac299b05b576de25df85d68c405d3f09b7141d9f80da83b0106035bf08b1b703aa1cbcf6271f19

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 a61e130824723561d705b61be064afbf
SHA1 c22faa4fbf041ca192b4a517f834d1661aa9d488
SHA256 1def505cd797b45bb6c1eae60a3f4ff5b505bd63623653fc1b05fc7e1ba19663
SHA512 65074fc23ff046454233cdedabedb355e5bf969520f1e2ebb0d889066b446da9ad51cb411d41524d4671a72c52967fba00f94c3fbb80e228a3589b6735602632

C:\Users\Public\Desktop\Firefox.lnk

MD5 b88e568112ba70ba71e14f0a74746ef1
SHA1 1ce75c63fb91178377633f4a0e4d13234049af07
SHA256 0494d50db0617bf649d8fc42cbfe1e9ca925783d9f2646a80f28c74acc85d16c
SHA512 db97ddfea8fc82479655310586fc3c08e8d9ecadefcc1e77a33a80a45380de6ae33f32d5aea1b9b154704d9300fb860e837cbd9c57e2267410038a875b897e64

C:\Users\Public\Desktop\VLC media player.lnk

MD5 a7e134aed6e8d69dce2f18228b00eb32
SHA1 3d04f47a302f4f315cc0d85152e443446c927cf9
SHA256 a7196280673c0fb8c6ac759e1864e7e2a04825ff76cd413eecb0d4c3871106ff
SHA512 13cd69f7cd142a695af0f450cf5203dbb31fa52991233f7a373a2f11e9bf82fd856f46446cb5f7b52cb51420c027450408b152449c7b7575f6e35881ad713d78

C:\Users\Public\Desktop\Acrobat Reader DC.lnk

MD5 7fdda83cf01ee93d1d92f4518d05aca1
SHA1 658fa399c1e5c713c056e3c4ccb9a66b5a947215
SHA256 11b994eb2572d93df0eb061e549015b14d7b52d75fcebfb9ea7d48fd7debc532
SHA512 abe2e8f437f08448bf27d9b4c681b2d3c31424e3bc14845c7f06c876ecc80b097cb7528076558a921f7e4ea23668b0b17eaf99ca846d0bc3b6752e48564becba

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 a062b8a2a8479e8dbde221974d7d57a4
SHA1 f20d128154d28e02da0ba7d03a478013d20c80ca
SHA256 99715cdb0625a4223a217f00c7d99513d0f7a9113a97c8b0b2b3f18d8883d7fc
SHA512 485f71f5fe21c8ebac61b8e9f4e65f77bf3679f2afa2ca64513a1746babdcc7211df34a77d6281ae3baa9eb2977f78a2fafeb7205b4aa626181e93232a515d86

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 ff70d10d23990709521e6f6a134c03a3
SHA1 7f1da6eb089f6e3028a8c22446ed62fa875e37fa
SHA256 e95ea7152a34217fa08b4d6a7cc57ca981159cf4aea1c127f61f8f7d472829a2
SHA512 157f4aac968458c972d9c89df92c90c79ed36b7640756a7d6bb4540d3b16d59cc87cdd240e72efc6aed36e051828b761da193cbe2182d15722ab69da23654cab

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 cdd6ecc9abbd37b1ee91f4345116caeb
SHA1 a22e34ccd3f149ed8917eac2b835b2551a51fe54
SHA256 5150d1c04736d24a0b70276ebcd830ccf65d9f4a6a9be7651542710a8b91daec
SHA512 9bc7f0a2168458eedef4c63e973d55657d3c90eac110e2d28fba1640c2b571c7c7ea9b628492e295e7610dc68ee99ad4ca3927db8a541416402e1867bea57da2

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 7752407a17949326f5e1c78eb8c0bc6a
SHA1 6e8458b4f7505f19559649d79499b3a7d219258f
SHA256 2553823fa58d8fe7b271eb2cdbce69c3a8ba6736bbcfa569d2f0743488ae5eb2
SHA512 6f25d99ed57912bbf3f7f03ba0489be022b76a52c3d5775250456d06c4f623f3e6f6e0ea7a6b69e20eebe28fccc83a2a74713ad8decb578b86b0ec61cbeaec7b

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 8bdf9c317f0b9d4a4a79405a037303e6
SHA1 d9b84a8f7b7000fd0648104998471fff52090cff
SHA256 2c0722e924c66dc5e9a60a8552b2618cdfb5c3ced5b04f081a8fc4db1e59171c
SHA512 0884f9bea3abde22096f890ed84c0a3948a99d71ee33d5272818b84ce586c560d42f8a7f2e6cf50fd0a8fc5d8f4f8678224480918b10239b1d1cffa8f93febe0

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 9f541c816716d578df0b08a845b2db30
SHA1 6adb6a58bcd7ee11be8c358674bfa62314147c0e
SHA256 9403a06ab4c11e4877d9de5c7dd4167821f9d90a25cf41dcf14a34892987239b
SHA512 d7d96186e6f0b2a13f83f1086b89c2e77e7520e7ed3e6a0b0b585802ed71ca0b029b2f1ffbf873d73f10c6853a235d5f80b519a968c02dad4fc927dffb6fefbf

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 ef813bc09072ce982ef5f19d8404c86c
SHA1 e6f5cae3e55acb1f67162c858a5b11409be2f153
SHA256 8fc07f9ed8804e3e2e60bec17daa86da8d50af0e51b65be7af893ef4fda59ecb
SHA512 d31badececf150e11ead2292f2e26f1cde606d1893055dd5215802cc307e71841c9ea53961a195db21755c186871d45428dc9b01a92f6837dc3ef1ad36bb688d

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 c674cc02d99471631391c25021da6867
SHA1 67e42738a9f20d8bdf24ab79d56a96bc080e9f94
SHA256 53d308c6c1a1fb87cf54e94245b2f8613848f8267294f6809108c0bdbc2d9293
SHA512 4860543f2f5f449bf5db2726e78801da93cdde44db21f15f9860049e8bda60ed220e2294128116930300e0b93f707a0e1a2c8aa112b012f3cd5b6c430e82658d

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 e854386c9679be4cc1f93174dc1ce80e
SHA1 ed85027aef9961ebde1e085306ffe6b2256136ce
SHA256 a63ea584c124edc3ab17e3a041b643e449d31a8eb024244e98cc26ec065deb31
SHA512 49e90a1fa851ad2134aae8f7a92145d83516c5cdb13a3116f4fbd250bda25f41df2aa8806179514cec09bdbcb08ed94233792aa789a98db4448b27eed643921d

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 5cd5451787360180e559f2b1af059a34
SHA1 70a023073418f7d1dfd26a19d082a9c83d046811
SHA256 f7d3addaecaea4e13117220e966014df4330547ee5ad01e17de8adccaafb8b04
SHA512 196acd51fc83541edc6df37ae36c6bf031e3f64c39bc805a4f6d9d897725c882300f011222f7c6e0afd21ad2c948952f6b25688eed0cb7c052118d61ed002f2d

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 09b2f5c138fcfb8dfbc2e2551540e454
SHA1 8ecf50c9ea22af2cad7777c80df58875a4eb994b
SHA256 90b874752a8c657dbca4cdbab23ff5f74aee0b69e8e9115fb9f69083267d5ce5
SHA512 8cfabeae73d70476a605075bf2a398d152ec236bd47c88c905510337509f87a9bb5b974f1de7fca2487d22eec763b0bd7b8e9b9b04a0fca6f717f8fe6825b429

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 680b95b0f474990e1b6206aadb3d658f
SHA1 521a561b6d4359850f995ab2a172dfcde168880a
SHA256 ae6371e4ca5a4e7d0f596a7707115c8c58a1795298cc0946da031b56e5088d3c
SHA512 ecbd88f4340ec61104cb38680a94278b1f748f98e28448e382b73b1c5793e0cf5e3c05e79a5d4acdf992e089112ff4ee58285e9386b9643f9902bfafb0e11927

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 c87b9b8243a3c28751a7c588d197c164
SHA1 93e80e4b7dc15b8e5bac90d0bc8f7b6e5f943443
SHA256 74558380616ef3108f8048491be8e503b5710e41912069afb80614be173de594
SHA512 59e3687d5a9fc509a33c0ec69e0b5c01cddc525dcf2e774b9b7cac9f00c1aa8d774ad96468d39c23ed9675e672a0982821e62fa1bd1b6ff8cbf88b8389da3eec

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 b03e13f65e5b79e737b6dfad8ff69b5a
SHA1 39c02ff13e0eff11804bef0ad5403be719076318
SHA256 604643a5d4e6c0e9f3b837e7cc30b501f716a87a2ee7b14bdefc6217131500e0
SHA512 7b8b6d8bdcd13816d0a03aa569531db9a3ee6eb7425ef1d90681674d8f4d375a83a739ad3f0ce4225b0252fd92241b891f5399cd44ff6db8618a70bdc33adf48

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 d6a46655dfc403d57bd34fc6122f55dc
SHA1 ec07fe0b1313b06232750aee157a78c80c5b0009
SHA256 b3e2ae927ebb1f76c26e8dc83cd0f78a23295ea004d5fa262ec3cfa31b8ed6ea
SHA512 a0e1b22f9e8700554aa9b350c8812a007412d6eafae88fa5b2ef04a8b8faf980a48cb0b1d901144f1a1428f09141f88f94ae02c6bc7831535d1ac7afc96dd04e

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 9c22fff77a77db8a7b53bfe4b0af1686
SHA1 01bab9bcff6f7f4f7034dfa75a3c8a0f721a988a
SHA256 dddfeb597ac199577db74cee912997c36fa4800c518ceb2f41ee742012d7bd87
SHA512 b4e36419524bc61f815cdaf71c191cbbaf53de3257cdcb73d77cedfce376d853df9c7eec3615d37795e9e0d1f0db096dde856cc1547ef013462dfc25346f1fe1

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 303b9f551eb4a2b835cc3b2b6951d20b
SHA1 202573070b10d5d6eb63fe50dc149fae8831765c
SHA256 b140fb49ceef92bfb94d13f39619544993cddf9bb873b7ce1aaa5f7b0b100932
SHA512 0435df60e05df0747bd52da9d4ae98b636da8becb4d3da4cc40adc8e66a310a1df8d0a58a80ab3fe169896250a262eb41c733ca7417fc4a246ffc17051ead5c4

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 dd842e4ed264e62d59fc8f92c65930ce
SHA1 c8032a9d8b18813fda0751ffe25177fafe41a130
SHA256 45cdb885483ca56bc00d6ab524849195241ec369af1af9b4987da922a09dedaf
SHA512 3768a1d8499bfb9bf18de37164473fbd2ab01fa9632c98b2eebf7c5b8a96f622b6aaf7b5f04088b05600c801bd5a120327706dbbc12fe3043b0022b4d0653af5

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 be82eaa7033d0a4116476434d302b27a
SHA1 a2b76b93a4a201b36125a517003a8cfa1f83b2c6
SHA256 bf8c758e9a2d785716dfabe62da638fb10d5064acd084dcac8b468645cc53f70
SHA512 46f4b13c3747b8e28ec9e9b24679910c690a48e6bf573f4406a09c08a3b13530501543ac46f37fe1332e6a73f1686d0c58117529c0cf360c8def6d29c9e15c4c

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 410ec69406ee7aa296ec4754986f8b5b
SHA1 7802f5d3efd006d7372687ae649eec70b7b9291d
SHA256 40fe5f78fb82a0344cceb8c37f51f938ff0e8824c02f993d31b4b16956e608a7
SHA512 52a1a1f6e963efa8c84c61553a2c0db5a94c167ebb28571ed1700416ade192123bce57b14507c99d09d88e79cc85b9cf62aae7b1a8f77bddf1fd08dd6c65be47

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 9c1cada49c6ab137d4ab5712e97a6e89
SHA1 94f6b6243feb7e167971a99c0538f9b18a54647e
SHA256 45c15d573e3f00f2f01344f4bca716ef3e76f8c3024bf8d4941a5478c51197c0
SHA512 09bb6f9b34f2822675bcacee7fe3e497c8db086ab85396a0cbe99403fec62c286680f3947691a23a6585561ad6ac036a972d8ddd422204a27f7e9482849cf385

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 58429562321c3af93b8712be10d2ce41
SHA1 60769e8f0964f83ae7c3afdde3d4aaeec6b704e3
SHA256 c8f2a55fc90af2bb25771e83c96d68184a26f37ca0809e9468d171e108185c7c
SHA512 bfad7af7aeb0efb33bd4ec204422bc57559cb5a8df7dd59f7a0e2fedcbb64c1a78b7198a086b4ef66f637bc907b632baf9b346db3fa72fa7174e275a9192cb6d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 19a8bcb40a17253313345edd2a0da1e7
SHA1 86fac74b5bbc59e910248caebd1176a48a46d72e
SHA256 b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
SHA512 9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll

MD5 c19bc1a54b8ea1fd0241b4a8827851b8
SHA1 5f3b45c5f073d3583c6d70765d7b392554d4431c
SHA256 6db75fdc6cbb380ee2644ae09f57378c761568b10912db6baa069f0fbf482f1a
SHA512 03f88f279b2e778bf68a34bf45e0e6d8dda48d0e7b0077e953f3bac6f169628a20786a9a9e2b1ca2e3e588d989cc9971336ea5b526058bcf535fba0837a4720e

C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll

MD5 5bc57b8e2e7590349002ac62bfb8e6f8
SHA1 7e53a7774c3cc0a204fa1cab0004869e78b2814a
SHA256 e2d7fa8b60d6fcf8d9afe7d50fdd6f6f3b5d3202e86635db01b6d732e8107e33
SHA512 e4e1ba330a9967582339a232b7d73c5be2758f763d9f582c55f583c22a43c044db2197939cc67c670577299bde9df1f6485e8b5c3fc438301d103fa23aa66c66

C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll

MD5 57c7b0a94744ce6523e9d5b3d87cf046
SHA1 9859cbdc1a458bcf9315d0d65ed2cdc562edda46
SHA256 7abf4f426525438d6a14b2b653c1ba5c5eea8af774707a47b1c9d7e44156ebde
SHA512 83a825effcc66ff29d1a15e9b9ba84d0a3b130a06eefe91df38b22b49c9259f98e8059c18e7e36eb52055c5627a4d7eaf64133ee1bcc482c3ab09f8388826c38

C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll

MD5 2580290b1e5712b0fefc38a6ff06e115
SHA1 1ce764c2d902db219bc764ed964cc234e3aa337a
SHA256 3c850de2119d6311dff3e575797a476011d8272007d7dc82ae47771c9811d2a4
SHA512 3101d88490dcf8717c504f7b791a236ba366060433aeb12d1b1d80b01bfe3b264ea787901a32ef6ec19c5e9be576bb0b19ef9ff15177644d05f6e2d80c3e28ce

memory/2548-20546-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/2548-20552-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/2548-20553-0x0000000002C80000-0x0000000002C90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9987f4963d82f073ee262bfeaa7f213e
SHA1 77e21a0a8c3507e4926ee23bafb157a3489d4cb1
SHA256 205cb970c164752d74ce6b94a02bd880129a1b4a4fa0eeba0456687451c223f0
SHA512 299399a1a49826ca7f461f12846d6035b73719c4ff27a44c8da157f3d729a033794cb3a97ec1dbc6ba12b10346d8f3acb627bad159ad97acd3879aad9f50b2a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 96899614360333c9904499393c6e3d75
SHA1 bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA256 486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
SHA512 974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat

MD5 eebfb84605e05222e3ad98f4b9f62db2
SHA1 36ddd440df5b2776281ad245a6a57e7a183c09a0
SHA256 4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559
SHA512 90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

memory/9808-20574-0x00000251A0360000-0x00000251A0380000-memory.dmp

memory/9808-20577-0x00000251A0660000-0x00000251A0680000-memory.dmp

memory/9808-20593-0x00000251A05A0000-0x00000251A05C0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat

MD5 43c3140f7b220cfa59f3971a6f2bcf2c
SHA1 fe02e892400b22a444b9152d54f493b94b2d530b
SHA256 338a9aa00f15339ddc4a0b897adc88cc1698146f6c1ac63ff1e56e68a78acee8
SHA512 aaae3c2fcb535acb1f432c98374a3bea9e199e0943e533cc27c10ee0c88937ea7c1e180adcfd4c5036455c9ca88c8787e5b9c7e3e0fc3f1255fdae5ac4a3772a

memory/9808-20579-0x00000251A0600000-0x00000251A0620000-memory.dmp

memory/9808-20596-0x00000251A0620000-0x00000251A0640000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 296fa8c2a080f462a3e4bb960c148cf4
SHA1 29e7586596d84aa5664faf67e40d4462eef6f0db
SHA256 d450393514d6d246d98a59ef5c2af663931c8ee31cc116d7bdaea793314ce06a
SHA512 fbd4b2b8718deb52bae5aa85ccc23111e03287e625b0bc20dc208e51f03cf81c29915f3f290283c5b8eebfaec5aeac463251373609d1b19573be692ae95a9c54

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 32e85cdbc193c8219483d495a5ebb933
SHA1 2977371dbc4202cedc0dea06852feedd69c3b5b2
SHA256 4776d26d0b676f7e806f1c19d03b0401b530d3e9561d25949d17fffa73d7b61d
SHA512 01082669c0b0344c76c76b40ee41ed8eba5ec9fa818e33606325765666c233aa0ea0e2b83672f4877ce546cbfea840ebef189794673fe8f44e80b0ebb6692cab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7c7ca10b7b98e1e107aec1c332d0f7c7
SHA1 649556545eb8baf80f520d8cec8089df7b1a2462
SHA256 fe7fa64e8744077eb22c5bd94255b9a9a6c4cbc0b52761f3c5e463e21dd7eec3
SHA512 fc7cbad7a5d0da8f4ad09f050ca78c6a17cffc2590a0833219b5410141e0329ab7ec3a2ef0ac82cadef4ea372dc4c71ce7f70d47e323a60a7be543c85b7518ce

memory/4908-20648-0x0000025CCEA40000-0x0000025CCEA60000-memory.dmp

memory/4908-20651-0x0000025CCEA40000-0x0000025CCEA60000-memory.dmp

memory/4908-20653-0x0000025CCED00000-0x0000025CCED20000-memory.dmp

memory/4908-20655-0x0000025CCECC0000-0x0000025CCECE0000-memory.dmp

memory/4908-20658-0x00000264E09B0000-0x00000264E09D0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 0be1206c110f2a1b2ae47487117ca67d
SHA1 caf5d063cc8910faa1b6b79405cc3474447c2a9f
SHA256 e3f8dab293453e0e21226ec36b23293665c8ff208135c392049be275b48426cb
SHA512 81b387f7e4f74074aee94ec93395c6b8cf902849c5b8441489e86aea035af64163abf212da3db22e0b65d03ffd65620e934a4d8b3279d74892028ed967e3df35

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

memory/9836-20684-0x00000231481C0000-0x00000231481E0000-memory.dmp

memory/9836-20687-0x00000231481C0000-0x00000231481E0000-memory.dmp

memory/9836-20689-0x00000231487E0000-0x0000023148800000-memory.dmp

memory/9836-20691-0x0000023148800000-0x0000023148820000-memory.dmp

memory/9836-20694-0x0000023148800000-0x0000023148820000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 7bb997d59d14682fb9a73e426244bf0f
SHA1 d048343419e8a8fbef67baa2403c2e870b3f143c
SHA256 433210abb36d097b856831364e89ddd463127a53cb44a92396ca39d14d4971e2
SHA512 24bc231d4d3090a5abf8b3ea72f9e402c9cf9ef6e7fb317c8ac7458ec15fb85d16f7d463c95ab74f41728db6d94bb0aa45bd51cd2e91420d03d148debe2c04d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4bab7bcdfadff3b6bffebe9b7834ca51
SHA1 938c5aa9e1c1022b93f416dc0685476ded9d202b
SHA256 df53c495410c2489c8717422d21bb0d94e81b97205158200f3b0dcf63f1fe3c2
SHA512 5c43a353bd198d9d707c2d12214de7eff6af070ed3135bd57ff2c17bc07aee1b0b391724907eabb546b5c273e70e56765de9ff3492cda218ac87773b46f60b4c

memory/7120-20804-0x000001BE069D0000-0x000001BE069F0000-memory.dmp

memory/7120-20809-0x000001BE069D0000-0x000001BE069F0000-memory.dmp

memory/7120-20810-0x000001BE06FB0000-0x000001BE06FD0000-memory.dmp

memory/7120-20811-0x000001BE06F50000-0x000001BE06F70000-memory.dmp

memory/7120-20814-0x000001BE06FB0000-0x000001BE06FD0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 7ceeb3853fb03da1c51e2abc66345df6
SHA1 f2d866a498cbf76d8149034a92a5fbc2a474b4ef
SHA256 1de8561e3d6ec45e17ec2b564a98cad277ebfd8adc1abfc1e40fdb14176a1a37
SHA512 94be259140159d7b38f6d9ead6f38b7ef021ce28800d218fbfc3d5bc2f4cd105a8e3890dd026b15c3eb6d6b6414f4f64cf58483fb5d9d5311c89fae2d4a2f60e

memory/9288-20836-0x000001B6993E0000-0x000001B699400000-memory.dmp

memory/9288-20839-0x000001B6993E0000-0x000001B699400000-memory.dmp

memory/9288-20841-0x000001B699A00000-0x000001B699A20000-memory.dmp

memory/9288-20843-0x000001B699980000-0x000001B6999A0000-memory.dmp

memory/9288-20846-0x000001B6999A0000-0x000001B6999C0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8KH8FA3J\microsoftwindows.client[1].xml

MD5 68ba7e3fad0c3fcec8e427f8511fcefe
SHA1 2290e7876be011f0d426764d25de76cfd2af56e8
SHA256 40db5979555ea51072ee6a150007e3da0fc2c29896a78577d8d287a1b35282d1
SHA512 43a3aeb6ae4b8f2cda2027726d514330d21da9b31c090dde5f99e7ec109345abed37cff9165cb37df542981ba3721e46b28ba2daec5ad50889068d51a82cdcd3

C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

MD5 6b3bd2edb1054bc9370b591d5cf6e9b9
SHA1 2811384c23caefda004928a1fcacda222e1793fa
SHA256 961e0957b61d7671e3f120c8ba7b1a8ddc50f2671516767907e121aa5c2dd03c
SHA512 e87e6a4824fcce081cfc4e805b83cc1f980fea87b36eb205f42533cef20ed36b47fdc9ab60f855c06a7d7c0c39e5741feccad9ff7f3a2fa5e034ec5ba4cbe2b9

memory/6756-20866-0x000000007FE70000-0x000000007FE71000-memory.dmp

memory/6756-20883-0x0000000002610000-0x0000000002620000-memory.dmp

memory/6756-20896-0x0000000002610000-0x0000000002620000-memory.dmp

memory/6756-20897-0x000000007FE50000-0x000000007FE51000-memory.dmp

memory/6756-20898-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

memory/6756-20899-0x000000007FE10000-0x000000007FE11000-memory.dmp

memory/6756-20900-0x000000007FE30000-0x000000007FE31000-memory.dmp