c2006d3fd1a8d1943421da6154751e7b53cc799a8bac833a6a95ef1dd2e06c45

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Size

1.2MB
MD5

603ab1d26637ce590df341e468795968
SHA1

1713ba54373bbdfed5b07e6244e1597ac94f5e2c
SHA256

c2006d3fd1a8d1943421da6154751e7b53cc799a8bac833a6a95ef1dd2e06c45
SHA512

81e29123cb6ce89e2442077dfb647b94752c0578507d2294135af8ef3ffb420f6f16d6d0a06be6a570143798adb63db3d874274bb9bab42bf190633419460268
SSDEEP

24576:Pj4SJslvwqeH5TDdy6gGYXI152bFYEGsMOPRgH8vt+t7d1LeEqotPntpMWhP+c3O:P8J7IaOac4Mn3tAjXLz

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\xa1Xx3AXs.README.txt

Ransom Note

~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

Detects executables packed with BoxedApp 60 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2852-10-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-1-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-0-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-2-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-8-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-9-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-19-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-20-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-18-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-17-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-16-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-15-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-14-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-13-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-12-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-11-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-31-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-45-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-56-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-29-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-57-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-55-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-54-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-53-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-58-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-52-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-51-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-50-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-49-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-48-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-47-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-46-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-44-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-43-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-42-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-41-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-40-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-59-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-39-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-38-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-37-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-36-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-35-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-34-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-33-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-32-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-30-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-28-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-27-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-26-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-25-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-24-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-23-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-22-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-21-0x0000000000540000-0x000000000063E000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-6347-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-10049-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-11071-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-11077-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp
behavioral1/memory/2852-12799-0x0000000000400000-0x000000000053C000-memory.dmp	INDICATOR_EXE_Packed_BoxedApp

Renames multiple (8832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

8804.tmp

pid	Process
1632	8804.tmp

Executes dropped EXE 1 IoCs

Processes:

8804.tmp

pid	Process
1632	8804.tmp

Loads dropped DLL 1 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

pid	Process
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\xa1Xx3AXs.bmp"	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\xa1Xx3AXs.bmp"	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

8804.tmp

pid	Process
1632	8804.tmp

Drops file in Program Files directory 64 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\xa1Xx3AXs.README.txt	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPDMCCore.dll	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File created	C:\Program Files\Java\jre7\lib\management\xa1Xx3AXs.README.txt	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.LEX.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00532_.WMF.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.INI	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.DLL.IDX_DLL	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFINTL.DLL.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management\management.properties	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\xa1Xx3AXs.README.txt	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\xa1Xx3AXs.README.txt	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\xa1Xx3AXs.README.txt	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO11.POC	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\calendar.css	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00350_.WMF	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLEX.DAT.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "10"	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Modifies registry class 5 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xa1Xx3AXs\ = "xa1Xx3AXs"	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xa1Xx3AXs\DefaultIcon	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xa1Xx3AXs	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xa1Xx3AXs\DefaultIcon\ = "C:\\ProgramData\\xa1Xx3AXs.ico"	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

pid	Process
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

8804.tmp

pid	Process
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp
1632	8804.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeDebugPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: 36	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeImpersonatePrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeIncBasePriorityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeIncreaseQuotaPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: 33	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeManageVolumePrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeProfSingleProcessPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeRestorePrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSystemProfilePrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeTakeOwnershipPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeShutdownPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeDebugPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeBackupPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
Token: SeSecurityPrivilege	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe8804.tmp

description	pid	Process	procid_target
PID 2852 wrote to memory of 1632	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe	30
PID 2852 wrote to memory of 1632	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe	30
PID 2852 wrote to memory of 1632	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe	30
PID 2852 wrote to memory of 1632	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe	30
PID 2852 wrote to memory of 1632	2852	2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe	30
PID 1632 wrote to memory of 2116	1632	8804.tmp	31
PID 1632 wrote to memory of 2116	1632	8804.tmp	31
PID 1632 wrote to memory of 2116	1632	8804.tmp	31
PID 1632 wrote to memory of 2116	1632	8804.tmp	31

C:\Users\Admin\AppData\Local\Temp\2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_603ab1d26637ce590df341e468795968_darkside.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\ProgramData\8804.tmp
  "C:\ProgramData\8804.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8804.tmp >> NUL
    3⤵
    PID:2116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\EEEEEEEEEEE

Filesize
129B

MD5
00b696b9db0713546fa65eb77db8ec4d

SHA1
80eb711dfdbf9e6c2ae7a767d2881ea75d81c9a1

SHA256
3aecac82053bdf48836dac18d08c79fe55ea75253890dff670cada1222c0a8ed

SHA512
8c9893fccf81173a99dc2b7a8572d7172d8ca200e3f3349589daeedf711a5583e1711738c34c8a4b850acdf3f4b5cf575b90504c885e3610283df8869a7da234

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Filesize
1.2MB

MD5
c1e6261ba404018bf2278f24b4cca262

SHA1
51e038f8b265ad00ef1a2718c15b713251aebc13

SHA256
87afc3178e50e112cf16f80a8d7aa1be09146c71c2198c8fe68e8dc0a1bfebb1

SHA512
a8731e28e986cd9ddd0b372dfcdda95b6467434f48b2963e37be815fb9e1e3621ce3b4167a284d98f07cbaca95f4a708aca56aaacab24fd391192b9baa6ae5ae

Download Submit
C:\Users\Admin\xa1Xx3AXs.README.txt

Filesize
1KB

MD5
b086e40671776e1878d78e5b77d87b29

SHA1
afc25200704f5e355a80a719e86a450295177606

SHA256
c99243fd5b4b2b5be708c0f30d095e515517f1e26a01032d05ad5ec6d6e4e2e3

SHA512
e813443a43ec149dc783d8f41c7e0abebf79ffa2718c33747a8d4a5cdc7ea1f9cbbc7ca7b2738ed4b724f246b0c56fa9f48c19f941174ddfc976216221480474

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\FFFFFFFFFFF

Filesize
129B

MD5
96f384c294aaded37e06824993af1956

SHA1
79d5f313d4748b6e66f352bb657449693d58f4b8

SHA256
5e215214657d226b9f7ee2de1c52c31b092333d69ff9d6285bba77de0a67433c

SHA512
f26104c37acee25a89c55cbeaa7bd7d78dc467ac0ef43f9961e6bd70f2f94c78240e9ac01114deb66bd2b5badd18b7401180487432372d04362697fc17115ac3

Download Submit
\ProgramData\8804.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/1632-12798-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2852-51-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-11077-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-2-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-6-0x0000000000428000-0x000000000053B000-memory.dmp

Filesize
1.1MB

Download
memory/2852-8-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-9-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-19-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-47-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-18-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-17-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-16-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-15-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-14-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-13-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-12-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-11-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-31-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-45-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-56-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-29-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-57-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-55-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-54-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-53-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-58-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-52-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-1-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-50-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-49-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-48-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-44-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-0-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-20-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-43-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-42-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-41-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-40-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-59-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-39-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-38-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-37-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-36-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-35-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-34-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-33-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-32-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-30-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-28-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-27-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-26-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-25-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-24-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-23-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-22-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-21-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-6347-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-10049-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-11071-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-46-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download
memory/2852-12799-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2852-10-0x0000000000540000-0x000000000063E000-memory.dmp

Filesize
1016KB

Download