Malware Analysis Report

2024-11-13 14:56

Sample ID 241109-c6pe7aykap
Target 2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside
SHA256 154d1ff5a5cbf6a3eef035232182a77d28c6fc3577d1b1e1c8d93a7f40114392
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

154d1ff5a5cbf6a3eef035232182a77d28c6fc3577d1b1e1c8d93a7f40114392

Threat Level: Known bad

The file 2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (617) files with added filename extension

Renames multiple (343) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Loads dropped DLL

Executes dropped EXE

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Enumerates system info in registry

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 02:41

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 02:41

Reported

2024-11-09 02:44

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"

Signatures

Renames multiple (343) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\DA0A.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\DA0A.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\DA0A.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"

C:\ProgramData\DA0A.tmp

"C:\ProgramData\DA0A.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DA0A.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/320-0-0x0000000002350000-0x0000000002390000-memory.dmp

memory/320-1-0x0000000002350000-0x0000000002390000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\HHHHHHHHHHH

MD5 02572c5f13e3fd0ebc2f93c46ed293d3
SHA1 4c596565026b02310a5718ce700de9581aeb274d
SHA256 abc3570f2a2464a6ce668f2a583e0a53154c85ebae55bab2dbc35f365dcafdc3
SHA512 994eef7859323273e63da125d19113a71d5cd98e669ca6fac9b48bcf6cccc6e7a964f96758126baeef48bd98e7cfae6abd10915b73fd1602328584e26e294f84

C:\KGYxjHxbi.README.txt

MD5 cfc0ce98168326c61ba0342995e1d972
SHA1 95a368c1124c8ef8778ffcb32fbb35bd9df5ac52
SHA256 2b044ddffd67c56645840dc99a6a20a77029b002a49bba631fbacc1d6f9045f0
SHA512 27921fe319f1c4c231b48fb637c0fa90ab0b49f06113da3f3c8daace41497396cc505fd50395034a3b1d8b2088450e9b22d5a0b1fb318ca460cc20060da6506e

F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\EEEEEEEEEEE

MD5 c60ec0f1723570730191b20fd02cdeb0
SHA1 b5e971062dd501b14c9c9e28b60af7bea87dc273
SHA256 36c83f114130ca01010b7484c0dff63ae8562f99be5557697e8c130d4c1160ba
SHA512 5b0e5ab1b04a81144f5e1fc734b4b64d07fa161782e30c50df9f589a80762dd11c9b3db7eb70772751f1c3b38b9f87d99cc57ad26ea20c199b32e1594fcfb29f

\ProgramData\DA0A.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2996-874-0x0000000000401000-0x0000000000404000-memory.dmp

memory/2996-876-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 49bcc1e4027b0f2f5136d942d5da578e
SHA1 f0973f7e87aecc768d49ea809ad45117fe365ba7
SHA256 d1b2fcdbee65ab8e5f9db34a39655f911a16a921c5f7b4b8e470cf7e4c1b22da
SHA512 cc314cba4328b58dd38b0dff3d1ff8f8f9304a4aae6a44c864fa896adbf70851ac931ddbae9c97deca1ce742a414658ef49bf393bf6cd98562b98d3eee1f3a5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 02:41

Reported

2024-11-09 02:44

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"

Signatures

Renames multiple (617) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\ProgramData\E408.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\E408.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\E408.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPx2k4svzn5odxwt0welcr701ac.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPky90eqltecg0_lnr0yz5mpaqb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPshp_kzcv277o2dvch9g_0ocab.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\E408.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3204 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\Windows\splwow64.exe
PID 3204 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\Windows\splwow64.exe
PID 1304 wrote to memory of 4504 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1304 wrote to memory of 4504 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3204 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\ProgramData\E408.tmp
PID 3204 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\ProgramData\E408.tmp
PID 3204 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\ProgramData\E408.tmp
PID 3204 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe C:\ProgramData\E408.tmp
PID 1048 wrote to memory of 1172 N/A C:\ProgramData\E408.tmp C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1172 N/A C:\ProgramData\E408.tmp C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1172 N/A C:\ProgramData\E408.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{E24BE056-5DDD-4BFA-AD07-EEAA57ECD319}.xps" 133755937043820000

C:\ProgramData\E408.tmp

"C:\ProgramData\E408.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E408.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 121.150.79.40.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/3204-1-0x00000000033C0000-0x00000000033D0000-memory.dmp

memory/3204-2-0x00000000033C0000-0x00000000033D0000-memory.dmp

memory/3204-0-0x00000000033C0000-0x00000000033D0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\NNNNNNNNNNN

MD5 6d06311db153c14a4c850d29288b4317
SHA1 0f01ddc82b667b918c44524519607822f297dca0
SHA256 85a63a7b2f83bbcaa25984e810885cf868bb52fcbd64290b5306ba7d21786248
SHA512 363ad2c060c8efa7bd76b315987ca93e6468e9de829e555ae606b8f37bbecbab9cfb22f2a87abba84ddb13820c64504339ce95f882ea9f34e2b6648865839818

F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\DDDDDDDDDDD

MD5 27b84425b936c9bc163dc892595503ed
SHA1 ea55e4f5e43007d96f69487f04dfb5e5e6b0df9f
SHA256 ca06af0a3b5225818988174b0bae936026f84105a86aa67858c74b262c7b240f
SHA512 152b6ef442194fd95c782eba22f8f3ba6d9b09e7edf2f1c3d58a51ac2a0c0859452357ce8baf6c5ab8bf0129ad1b90dd2960e1b830ecc2cdbecac7b489a0e55a

C:\KGYxjHxbi.README.txt

MD5 154f3bff3a4dd1a99bb3db81f7e6439c
SHA1 8d335ac1f3bd91d0df0fac05df2a978bbd969a0d
SHA256 baf9c533562e5e082be2c4c088d7a29ad196c682bb0a92586912cec9cf01ef93
SHA512 9877d7ceba9f3f3b1b3bb9d373fb51aeecf491093771c1aa9bd060fd417c3cc61defe38ce64afe0b0b0568365280cb26e09c2646dd59bc2d8ee8222a14df6add

C:\Users\Admin\Pictures\My Wallpaper.jpg.KGYxjHxbi

MD5 1f23d6fe2f17ec87291c02d455f44e3a
SHA1 af522cf98d25baa2dc92a22991bb08b828aecea7
SHA256 190a795fbf9e2dbd9cf6f7975712f1ed582cc6178032aed2456466a14b3eaf8a
SHA512 2f5070837bcf873dae322597f0fcc0210ea463d1e63bd3e9113eda54588e47829ed3b0d18dd5d2fcfa604bcc5a24037ece770e4dc045e9d16400c21cf56b2822

memory/3204-2964-0x00000000033C0000-0x00000000033D0000-memory.dmp

memory/3204-2965-0x00000000033C0000-0x00000000033D0000-memory.dmp

memory/3204-2966-0x00000000033C0000-0x00000000033D0000-memory.dmp

C:\ProgramData\E408.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4504-2981-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

memory/4504-2982-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

memory/4504-2983-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

memory/4504-2985-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

memory/4504-2984-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

MD5 ac1046c18a98aa08612052d2258e00a6
SHA1 7f05da660160b76cd4b1f2909bec0aa102620f4b
SHA256 4d17477b7ca826b3d5cf2d62eef81278809a9e5400b84c90fdcda14269063c38
SHA512 eff75e35fb767b301082eca7054745bd6284ad49aa3ffac57eba47b70a7fca1fd181ed8dcd49b84b8466a7a04390dbe08367b8c0994802fdaa2c85ef585071a4

memory/4504-3014-0x00007FF90B350000-0x00007FF90B360000-memory.dmp

memory/4504-3015-0x00007FF90B350000-0x00007FF90B360000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{E69132AA-D38B-4635-AAE2-BCC64BD4733D}

MD5 2367cce81582477f2edad7d876645ef4
SHA1 58277e9d31fd95b82c492d900be645ae4f68438a
SHA256 fc2263c8334d5c4452ab554f6a57c763597d12eaae8234068b7061b2a3c1a4bb
SHA512 ec0a3aa6f24c911e69da0670a519cef4a2ce17d105bb66286067b593d5b71cadfb4d826313daef4f2744de7ce5404b4d3c8ed62a49791646ffe0958921157394

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 d12c7a65af271d663272bca651b25ef5
SHA1 deaa93b371f85a85f2c86503abdf61ffa6065fe9
SHA256 b6fcb45bc71a5338181bc115c05d76ea723aa3cfe60c16a662da5b44ff963ab2
SHA512 3cdb8d03c29011fe446b15000778c5a296b6f48ed7bdb264e6417fe2ee96af3e5ceb207db3ce83481ba6b2735a8f6fe1ea0444a77f3909f2a7eec2845ec97e04