Malware Analysis Report

2025-05-05 20:48

Sample ID 250420-t1n1xazxd1
Target 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit
SHA256 37bd15c4b02a4e8271590ca9d448e1340cbbdda44ea3f46f199bf2c047c33dff
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

37bd15c4b02a4e8271590ca9d448e1340cbbdda44ea3f46f199bf2c047c33dff

Threat Level: Known bad

The file 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Lockbit

Renames multiple (549) files with added filename extension

Renames multiple (299) files with added filename extension

Executes dropped EXE

Reads user/profile data of web browsers

Deletes itself

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Checks processor information in registry

Modifies Control Panel

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-20 16:31

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-20 16:31

Reported

2025-04-20 16:34

Platform

win10v2004-20250410-en

Max time kernel

1s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (299) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2645532622-3298555945-705856666-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2645532622-3298555945-705856666-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA\ = "mXWb45OeA" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon\ = "C:\\ProgramData\\mXWb45OeA.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{03545183-C289-4A62-93DC-A41BEBAECB79}.xps" 133896403091280000

C:\ProgramData\CE9B.tmp

"C:\ProgramData\CE9B.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CE9B.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/4068-2-0x0000000002F80000-0x0000000002F90000-memory.dmp

memory/4068-0-0x0000000002F80000-0x0000000002F90000-memory.dmp

memory/4068-1-0x0000000002F80000-0x0000000002F90000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2645532622-3298555945-705856666-1000\YYYYYYYYYYY

MD5 361f8c4b4f7bc1dbac8301a32c6587bb
SHA1 2d560909ef930d021881d360dc9e92bde2996c5a
SHA256 fb059564b32b07b67246adfb275ceb40f45d533b1b28a688b65e06879e13ca8d
SHA512 17c50bff9abc038261da7223f8dc45ace0f4d748958f27794fd7ac3fecd3141983bffc3a1b4c7741a41eadeffbff4f312235e84af02f35144df6b832266dd7b6

C:\mXWb45OeA.README.txt

MD5 111f363a316f1f635ae0348e61d439b3
SHA1 a80a0930e07e13ed3062e194de70b65779b2dff8
SHA256 8900d8a0e1eb62c22a2daaf68f973f9b82beae7110909ed242a6cc4b77db1483
SHA512 c820b78b7d4a8c8e5c6c7a5460ecac3def75b276af81196e395b8e4c568121d8ba75ac351ebfff5f3bdf714827fda0b31e5f48787eb4a5f9ce2655d00ee28edc

F:\$RECYCLE.BIN\S-1-5-21-2645532622-3298555945-705856666-1000\DDDDDDDDDDD

MD5 31f28414fbf93e5f5408056b9fce9027
SHA1 0682416ba672c027fcd59ac5fe676ddedcd131e0
SHA256 81911ae9fcf437a65e25250af6a098331c1f29cc9bd58f8cc8ed2da2ac7a8170
SHA512 645dba403211be25a9b1e16340a586cc2a723926a3cf502500176dd9ad9524469d52a27a69cf2ec45f31ab57eead15a556df91f548c9689bf3360682b720c698

memory/4068-3589-0x0000000002F80000-0x0000000002F90000-memory.dmp

memory/4068-3590-0x0000000002F80000-0x0000000002F90000-memory.dmp

memory/4068-3591-0x0000000002F80000-0x0000000002F90000-memory.dmp

C:\ProgramData\CE9B.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2688-3610-0x00007FF863210000-0x00007FF863220000-memory.dmp

memory/2688-3611-0x00007FF863210000-0x00007FF863220000-memory.dmp

memory/2688-3609-0x00007FF863210000-0x00007FF863220000-memory.dmp

memory/2688-3607-0x00007FF863210000-0x00007FF863220000-memory.dmp

memory/2688-3608-0x00007FF863210000-0x00007FF863220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 4a3fa1326214072efb22c38ce9d73a98
SHA1 95ae2b2702e43848cb25f71f8aabd9ceb45fb5d5
SHA256 7e6f8d3ccb8bf6d41e35af4eb12674a2d06f06074869d709234538be8d47a9ab
SHA512 2bbd28aae758338787a5ed6b5cc09e5d72030c91a9ff070711b0ae57d150448e8cb1432ad449cc23616c63c254ec1d96175c79d06eae2fc55309890527764493

memory/2688-3640-0x00007FF860EE0000-0x00007FF860EF0000-memory.dmp

memory/2688-3641-0x00007FF860EE0000-0x00007FF860EF0000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 591f505fc7bad6353c980ad842c333e0
SHA1 8e84a3914e74573480a6df40935497eef2a399e4
SHA256 603b6cd73989c82b7fcf1360ec254f28be574fcbde6b94477ac135ace5d8a94c
SHA512 2bb8d4569dfcc9b0edbbf9b82d66fdf1a5189472c03842a2374d808a7e576022b42d2f4461bf104c14338f513696b5e0d91fb02f414d5188fbf267e329274e61

C:\Users\Admin\AppData\Local\Temp\{5EE9230C-A4FC-473E-90BF-7B0A5BD5D0D0}

MD5 398f3fa97c23f7af331603fffd0130b9
SHA1 b0e8898d989ed4ad23c4205e39007e19003e9b3d
SHA256 677e41a612150949bc6d584b991b478bd47c5379d4d0e5045110d359b6c55b59
SHA512 92b391d16eedb01538baab97b47931a9a041deb88264ba97a163c2b25f6d7e4b0322059d6d89a8235a8fea5873f4d559d8e302e5bdf06d276a6f4cdccf74148a

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-20 16:31

Reported

2025-04-20 16:34

Platform

win11-20250410-en

Max time kernel

147s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (549) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9ACA.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9ACA.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-4144164418-4152157973-2926181071-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4144164418-4152157973-2926181071-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPgh3nso3vdx558mv_6ayzxkx3c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPlwjvsirn0zu4zr42wlqvm_rtb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP4wt9rscpbk__rpa3fg5kbexjc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\9ACA.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\9ACA.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA\ = "mXWb45OeA" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon\ = "C:\\ProgramData\\mXWb45OeA.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5900 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 5900 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 732 wrote to memory of 4168 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 732 wrote to memory of 4168 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5900 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9ACA.tmp
PID 5900 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9ACA.tmp
PID 5900 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9ACA.tmp
PID 5900 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9ACA.tmp
PID 960 wrote to memory of 1616 N/A C:\ProgramData\9ACA.tmp C:\Windows\SysWOW64\cmd.exe
PID 960 wrote to memory of 1616 N/A C:\ProgramData\9ACA.tmp C:\Windows\SysWOW64\cmd.exe
PID 960 wrote to memory of 1616 N/A C:\ProgramData\9ACA.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2BFC56F6-267A-401B-91F8-1BCC60CC82C1}.xps" 133896403076510000

C:\ProgramData\9ACA.tmp

"C:\ProgramData\9ACA.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9ACA.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/5900-0-0x0000000003400000-0x0000000003410000-memory.dmp

memory/5900-2-0x0000000003400000-0x0000000003410000-memory.dmp

memory/5900-1-0x0000000003400000-0x0000000003410000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4144164418-4152157973-2926181071-1000\UUUUUUUUUUU

MD5 aaf69ab0f11a2aad3d27d81c0db3e4d9
SHA1 6b0a721983dff4a6a5776d4dc8aed7336ec75dad
SHA256 7362e0036611fcf4281c946b9635ccb2be1053558f84f5580d94997bd0be7ad1
SHA512 eb550bdf6d6f790201787c147b134b2e37c8a1b0509a36d0af5edf528c912784268e9e3b397ace56e5f9f624d3642057941dbcd76814f7ff19b062d74a2dd410

C:\mXWb45OeA.README.txt

MD5 49ab6fc5f78bd8c6fc08991ddea8d04a
SHA1 613a31654a11af0fbfd18aa1e60f9fbb96b13434
SHA256 b87d301f137e2cc39f60de79c01c1da6b69cba3c34dc6883f119cfd337f5d7c3
SHA512 c36204bd8936d2387e8737f2fd4cd31f3f7664314419879e093e61ac1b546f485c840da169b27eaadee9ede5927b24db1fc3f6007c846735835c304eea89d554

F:\$RECYCLE.BIN\S-1-5-21-4144164418-4152157973-2926181071-1000\DDDDDDDDDDD

MD5 ea766fb82b6437639a8fff1e3a1c205a
SHA1 c95a1ef36758321edd92e3325a0c94538aa0148a
SHA256 8963008f1ee245b2e8094d6454fb30e395e996a1cee5ba3e8c8f46676597dad2
SHA512 0fddc12d4ae73871665ca5acba7ed8d5dd51ba6abd692a5204528b34919e84bb4f11a98afad37fe0ef8fb0f3e68ba16a1e4936c432ffa28ac6e8a399b5208dad

memory/5900-3550-0x0000000003400000-0x0000000003410000-memory.dmp

memory/5900-3551-0x0000000003400000-0x0000000003410000-memory.dmp

memory/5900-3552-0x0000000003400000-0x0000000003410000-memory.dmp

memory/4168-3566-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

memory/4168-3565-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

memory/4168-3564-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

memory/4168-3567-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

memory/4168-3572-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

C:\ProgramData\9ACA.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

C:\Users\Admin\AppData\Local\Temp\FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

MD5 3a925e27642d1d515138df439c1c12f7
SHA1 3c8746ec43acfc0f813e7f4b963eee6c47a5b148
SHA256 de165c42ff822c05211750c520b00a7de84571524e1bd55fb3ab666fe2d2bb49
SHA512 7147a7885edd764636032daca3a0a54d6f8f496034cf384a21e11b0354b7717e9bb939a21eb2a5c634403f2e162282037c7fa1c099b81a904c3203d6c10113f9

memory/4168-3601-0x00007FF838360000-0x00007FF838370000-memory.dmp

memory/4168-3602-0x00007FF838360000-0x00007FF838370000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{1B374E3E-E68A-4789-876F-8A09B779BEAD}

MD5 2732190a0088ba4da914b01c404b1ea5
SHA1 24808cc5e48b0a7cc23d0cdc08abdeaad1879e12
SHA256 e0c421d88207df70053510e0cc98e57545b94879d9541c651792831ba71bd856
SHA512 7142df96110de7cd7bdd592c91c93cadc6c44c3c6f3c078e64317b2bea858095b65102d17c23a5565be4c8b98c3915f95ef8837d04b42ca2f327266296beed60

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 b73853720176b4d2d8f244748a774ae9
SHA1 ea6bd4859234aa0146b82f507f2334f8b9375e6a
SHA256 56c90f6d7fd345b0a4988d45cad69a83d6202653dfce4f0b3fd06c93efb6d186
SHA512 44675ca878e3bd4baef8a7a4a73ffe48220be1c4c3b687dd423873c726f865af7682bd3b2b80b3d5adeab349125cfed059294fb6b308db6caf408277a6605ed4