Malware Analysis Report

2024-11-30 11:30

Sample ID 240227-q4644sah9v
Target 2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside
SHA256 e4e6567b1861ca066a60c3257baaa5ef495694ca66b87647b36008500c935bcd
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4e6567b1861ca066a60c3257baaa5ef495694ca66b87647b36008500c935bcd

Threat Level: Known bad

The file 2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (337) files with added filename extension

Renames multiple (593) files with added filename extension

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Loads dropped DLL

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-27 13:49

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 13:49

Reported

2024-02-27 13:52

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe"

Signatures

Renames multiple (337) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\E485.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\E485.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\E485.tmp N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe"

C:\ProgramData\E485.tmp

"C:\ProgramData\E485.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E485.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x158

Network

N/A

Files

memory/2772-0-0x0000000000330000-0x0000000000370000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini

MD5 068436048c9ccf20512498d7c27cd6c7
SHA1 ea8c758ad7ebd28f5b4a098996b7ef2be4b457e2
SHA256 df3a0f302ea5a23f1a3e6347ae87419c6d9b2525985b20075190a5c22d165f07
SHA512 7a7c8ff6ec15e8563d9335181c90b59e89ae79ac06d728d8ad653e549f3fb520cfb706c4f64ab6d1e307bc7a0bb2874d5e0a2ec318e4fc7730693e4d4f3a3ae7

C:\iBUgUvnWk.README.txt

MD5 7c3d34a06bb11ab8383e8afa4c60434d
SHA1 f87e16c6e6d36e70f436228aa3244dfb76f7fc2c
SHA256 2639d017985bafc4a1b213f5b9cf9409a16bc4b01ece1952bc4360a03bf3066a
SHA512 7969f6b2b9b5586fedbda52b895704fe2ba31bf7914a04dea790d2787326c66cfb644baf4c913adad22929d4a1e1f3e5d17fc369672f411d857aa456c3ab57bb

F:\$RECYCLE.BIN\S-1-5-21-778096762-2241304387-192235952-1000\DDDDDDDDDDD

MD5 30696b6d0b7ea4ba76a834bcdc648190
SHA1 2891aa539f2266d6028ae4b9f1bd28738517e7ea
SHA256 c02376b33af5bb4566dd1245b9e47d6b3b418ac8bba1756f1a4ea4191fca031a
SHA512 4b701abf6d3ef57a22424416151ea40f5bf489b5e8ca9826d7f99b8f26c0b5232e5463569d7d99ca76459a820813861c4eb86e696a81ea35913d377fcde3b202

\ProgramData\E485.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1032-852-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1032-854-0x0000000000230000-0x0000000000270000-memory.dmp

memory/1032-870-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1032-871-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL

MD5 a6987584fd9ea50e2e6e0efd0c455a2d
SHA1 92c39252dac5919773bdd1617a52a7cbf3be5d41
SHA256 7fe2765dd9ec71518ad9a7fbe4d20e2a3bd341110f7ae56210d9f406e14c958e
SHA512 48a0cdba221f13d263a7c37e119980f1391285812cda3e8f90637a1e7ade227f8cab663ded73998f7839d9e218bf7143e6b602bc59224d0d5c1ff1775c76b805

memory/1032-884-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1032-885-0x000000007EF60000-0x000000007EF61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 13:49

Reported

2024-02-27 13:52

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe"

Signatures

Renames multiple (593) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\ProgramData\B7A7.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\B7A7.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\B7A7.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\B7A7.tmp N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-27_9b7027b10ee698c1588def9cbcdb03d8_darkside.exe"

C:\ProgramData\B7A7.tmp

"C:\ProgramData\B7A7.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B7A7.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 234.17.178.52.in-addr.arpa udp

Files

memory/4644-0-0x0000000003210000-0x0000000003220000-memory.dmp

memory/4644-1-0x0000000003210000-0x0000000003220000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini

MD5 0c7d65178d618726eda926ca21c7658a
SHA1 bbb9aaafbade5373137c9be3b7a719728cb08311
SHA256 f622a96652add16624ab4f0f7b7b22d7c96f3d90c04605f9d34c0a70568bf83b
SHA512 684451963ffeb74fecee2994b65e35dd2eb7609434d07d410a638a44d1254c9c9c0fffd87d66bbf901c22229d49a49317d8ec5b092b8a62e386296b4f75277eb

F:\$RECYCLE.BIN\S-1-5-21-3045580317-3728985860-206385570-1000\DDDDDDDDDDD

MD5 45d72b27d6576c1663e4620054d7edeb
SHA1 24ac4e284ca3cb295c7791e40c962a69a1b59fdc
SHA256 cb60d0a53139ff7d69f09fd98391a62791c3008f117af32a6d425b0eeb266ea9
SHA512 29b5176cc6f0bcd45cf1be90de38acac7a967c7ae4894eabfaffab526b2db4e8157e11957e8aebcc68570c9c3eaad32e245967110aa9b1de68c9efb9d6ec419c

C:\iBUgUvnWk.README.txt

MD5 7c3d34a06bb11ab8383e8afa4c60434d
SHA1 f87e16c6e6d36e70f436228aa3244dfb76f7fc2c
SHA256 2639d017985bafc4a1b213f5b9cf9409a16bc4b01ece1952bc4360a03bf3066a
SHA512 7969f6b2b9b5586fedbda52b895704fe2ba31bf7914a04dea790d2787326c66cfb644baf4c913adad22929d4a1e1f3e5d17fc369672f411d857aa456c3ab57bb

memory/4644-2734-0x0000000003210000-0x0000000003220000-memory.dmp

memory/4644-2735-0x0000000003210000-0x0000000003220000-memory.dmp

memory/4644-2736-0x0000000003210000-0x0000000003220000-memory.dmp

C:\ProgramData\B7A7.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3344-2741-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/3344-2742-0x00000000026D0000-0x00000000026E0000-memory.dmp

memory/3344-2743-0x00000000026D0000-0x00000000026E0000-memory.dmp

memory/3344-2744-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/3344-2745-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 85a8d90ce0448facf98970eb5b650d8e
SHA1 798867e3714a955bc657e31dd05f53a2c005709f
SHA256 55d881d8f1af87636cb09d664c5d1ade69c93e496343e0610afbe43a4a6f6c88
SHA512 4d7d54f9fe8de14266d8a5d0634f15486ccc0877a53cf275513fa2390e0174187699a798bf14e45691dd09138e5d51d239de380f9d79fe60a4f164e64f6edc9a

memory/3344-2775-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/3344-2774-0x000000007FDE0000-0x000000007FDE1000-memory.dmp