Malware Analysis Report

2024-11-30 11:30

Sample ID 240228-tnhy5afh7y
Target 2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside
SHA256 afefd126cdd122b02b29b3ab90d858ca129bdee1e80d23a853aebcb16ac4aa14
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

afefd126cdd122b02b29b3ab90d858ca129bdee1e80d23a853aebcb16ac4aa14

Threat Level: Known bad

The file 2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (645) files with added filename extension

Renames multiple (348) files with added filename extension

Loads dropped DLL

Deletes itself

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-28 16:12

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 16:12

Reported

2024-02-28 16:14

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe"

Signatures

Renames multiple (348) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\2443.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\2443.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\2443.tmp N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe"

C:\ProgramData\2443.tmp

"C:\ProgramData\2443.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2443.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2912-0-0x0000000000FD0000-0x0000000001010000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini

MD5 ee34ec5c9e1deb023662b2c54d0361bc
SHA1 8bc4c392b943716b6ae9fc238c828970f3cdf5c4
SHA256 695685dab3b14f535b14c2a4d66f3f873560e6419bbea771be3ae91174f7871b
SHA512 e2ba727701be91dc0a5eaab9ad923a395836aa4c34826c748a5186608af96923ecc06a31886f321e9b97a7ebe456e094fa32d39e9da75dd20ffa36b94b949ce7

C:\iHpE7aGA3.README.txt

MD5 481f6946b253bb263007b53a2010c7a4
SHA1 fd65cc5ebca40e832d31601e4304e0e1e2f5ea89
SHA256 34b4b51dc57d0cd622e0c06811701b615d01a85f8c3bc41f13ce9304b99398f7
SHA512 a6e1f48429fb3649180ae94a3f826684b16d1db9dfc699048185182049fc7058e517e3583474b1124bfa4425057633967ec07213fb02af9481a5cf8a0ba1aa98

F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\DDDDDDDDDDD

MD5 e7369f179ae1030b6b582cc2bae7368c
SHA1 23853f0ead728188e8c1d4bbe3c6b3f3b8d24342
SHA256 9754daf0693e7b5e98eb43701cc55cb50db1b58d717d847f1928263b13eb4101
SHA512 ebb310cd79eef0a3769a09c1013c4abff1e2917ae9727b3ae0963efdc79eb2c685185bd1398b1147f840b3fef08c2f877775b81e69dd397d0e1cae14411678a5

\ProgramData\2443.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1408-871-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1408-872-0x0000000002270000-0x00000000022B0000-memory.dmp

memory/1408-873-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1408-875-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 7a27ce2318bd0dec7f6316e8e865d0e3
SHA1 931fb0c5607479f747e3dc898f6ca527b6b323cf
SHA256 d94f36fd5feb41f200663628eed3792492965259db1444146c832905c0ddf66b
SHA512 b3081f0aa301a92d4ba31daf3602b316d481cc3d47098a912aec0a42f1ceab60058b1fe321be583ebf8c1066aff4fd558e70cae1ab2ee7c4723bd70cc9d407e1

memory/1408-903-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1408-904-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 16:12

Reported

2024-02-28 16:14

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe"

Signatures

Renames multiple (645) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\ProgramData\8123.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\8123.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\8123.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP9oohms4_cmx1pysvev1krrwj.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPlxnh1b8l60uupevtz_giowv9b.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPqb7npv6em8zh0jh8dueqiq6zb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\8123.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3764 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\Windows\splwow64.exe
PID 3764 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\Windows\splwow64.exe
PID 3764 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\ProgramData\8123.tmp
PID 3764 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\ProgramData\8123.tmp
PID 3764 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\ProgramData\8123.tmp
PID 3764 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe C:\ProgramData\8123.tmp
PID 4016 wrote to memory of 5028 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4016 wrote to memory of 5028 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 892 wrote to memory of 3832 N/A C:\ProgramData\8123.tmp C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 3832 N/A C:\ProgramData\8123.tmp C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 3832 N/A C:\ProgramData\8123.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f3ede646eae59fa588bafead6e1984d6_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

C:\ProgramData\8123.tmp

"C:\ProgramData\8123.tmp"

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{70769267-5EF1-4E50-8394-D43841EA55C4}.xps" 133536103753900000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8123.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
IE 172.253.116.95:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 95.116.253.172.in-addr.arpa udp

Files

memory/3764-0-0x0000000003420000-0x0000000003430000-memory.dmp

memory/3764-1-0x0000000003420000-0x0000000003430000-memory.dmp

memory/3764-2-0x0000000003420000-0x0000000003430000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini

MD5 b66735fe6e64c10c385f74f14f4204ab
SHA1 213b03958db74d2a489093af93d74c5f4ebb04a5
SHA256 2ef4e39246eefa74d1bcbe0d71e0c2f313397c32806fa010251bb00a18925ff5
SHA512 1f40ddff829a1c1de7d6cedae1283ef744faf31a5d0c0c1ce66d20b361336fdf36bf005872c12926e0a52ca48f910593e5696ce9adbad057d98701b29cfce872

F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD

MD5 86d5510ae04c7129afb4dac80f07a63a
SHA1 7078299e0b3057524a4a14e9ffd0aca68a8ea435
SHA256 74b4ff87113b1f2d0a91ee247bdbf992bd4234783fe905671a6c53e847d0ef7d
SHA512 290a76d1594ca388e45beb823914aaa8fe2e607571f925eca8cae6afd3aebac08e31c43b9f6227e14b155384b14bfd0e6de3f00c097fd902c0aef2d7a85ccffd

C:\iHpE7aGA3.README.txt

MD5 481f6946b253bb263007b53a2010c7a4
SHA1 fd65cc5ebca40e832d31601e4304e0e1e2f5ea89
SHA256 34b4b51dc57d0cd622e0c06811701b615d01a85f8c3bc41f13ce9304b99398f7
SHA512 a6e1f48429fb3649180ae94a3f826684b16d1db9dfc699048185182049fc7058e517e3583474b1124bfa4425057633967ec07213fb02af9481a5cf8a0ba1aa98

memory/3764-2823-0x0000000003420000-0x0000000003430000-memory.dmp

memory/3764-2824-0x0000000003420000-0x0000000003430000-memory.dmp

memory/3764-2825-0x0000000003420000-0x0000000003430000-memory.dmp

C:\ProgramData\8123.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/892-2832-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/892-2833-0x0000000002470000-0x0000000002480000-memory.dmp

memory/892-2834-0x0000000002470000-0x0000000002480000-memory.dmp

memory/892-2835-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/892-2844-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/5028-2846-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2845-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

memory/5028-2847-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 21d2af595154c2feeb1e54a3772aec51
SHA1 c33c536edd8031afbb9cab531008529e388bb820
SHA256 10292dd1bfb95c83901d5843fad79f6ad13577a1054aa81720b444d0a44cda40
SHA512 24093741e31b2b8d6bcf60fa06fa77be3c10ba6d04b3fda13ea462094753c4596eb4967b768a5c9e94bcaff694e4566edbe1b18a7b0ce1dd35a67f8d2bfbf8df

memory/5028-2878-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2869-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

memory/5028-2880-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2879-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

memory/5028-2881-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

memory/5028-2848-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

memory/5028-2882-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2883-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2884-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2885-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2886-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/892-2887-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/5028-2888-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2891-0x00007FFE704A0000-0x00007FFE704B0000-memory.dmp

memory/5028-2892-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2890-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2889-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2893-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2894-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2896-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2895-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2898-0x00007FFE704A0000-0x00007FFE704B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{BD81125D-0B35-4232-9A82-0D9D3F252B7C}

MD5 a9f7b85c2d9f915195230e88a3e2a48d
SHA1 e40e8e423f661474dbc33eb2dc18055511ca0b2e
SHA256 1f0abf5c1b7a5f5208a8648b8a61ac56ae2d0d28109fd671698d8d33eeecd5af
SHA512 f41268151f6b054c0541ff0f4846b8ab241ee5beb2ea1e5bd72603bf0cbf1fd346f2b68fa4f97bdaf9c1ecb9fcb969be30afbef7806fb41caf4db47abf518726

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 a86a0252419e8b616f3e7c1f44cf874b
SHA1 fc92cd276d87f3e9ddb9f32ab856b50170420748
SHA256 af8671cdcece59ff70e3a08a162a55727c278a2a45e239735c4586b8d5c73e59
SHA512 2d630248e187bf494a1bff01e4638691de117786bf4669e7c077dd50e3f623d7890e333923ab4360d94a6f481825a7e1f2cc07d5d8ecb2194e92774a04ffa60c

memory/5028-2916-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

memory/5028-2917-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp