echelon | hxxps://dropmefiles[.]com/brqGr

Analysis

max time kernel
237s
max time network
234s
platform
windows10_x64
resource
win10-en-20211104
submitted
27-11-2021 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dropmefiles.com/brqGr

Score

10^/10

echelon spyware stealer suricata vmprotect

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata

Executes dropped EXE 3 IoCs

Processes:

Nemesis.exeA.exeA.exe

pid	Process
2684	Nemesis.exe
932	A.exe
2504	A.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/files/0x000400000001ac7e-237.dat	vmprotect
behavioral1/files/0x000400000001ac7e-238.dat	vmprotect
behavioral1/files/0x000400000001ac7e-247.dat	vmprotect
behavioral1/files/0x000500000001acb3-255.dat	vmprotect

Loads dropped DLL 1 IoCs

Processes:

Nemesis.exe

pid	Process
2684	Nemesis.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
141	api.ipify.org
142	api.ipify.org
143	ip-api.com
148	api.ipify.org
149	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IEXPLORE.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d17a577ee8d1d701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "461"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{63D9D94D-0776-408A-90EF-496E378D8405}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "28"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "460"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "783"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "461"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "90"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "344768895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "131"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "783"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "460"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "808"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000575b43798c32d596d90c00620cecacfefcf093cba090dd83a9b585f992e9c6b3000000000e80000000020000200000001fa966f1cc2a9700207d1e2fabf3555d28ee810c6ae148ddf1eed31fbefac3dc200000000cc4e38f9b10ed7924bb8adfd69023ca3aa0b53aea14575f089ef9517452a2d240000000c18ab99c258c77c7eb846e96dc948acc033c324da2fb45e30bc8840c65c3f899b4a466ed5f6c49f18069f1701c85c92b20b3e902dc43a1e0249fdc7fcd064bb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 13cba84c6ee3d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "75"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "748"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000aa897a14a8f6b5f8d79e63b6692ae59a6c9ea7438f7fa6cc1253658c886045ab000000000e8000000002000020000000568c4838e8372f078c9c8f27db4f2f07ea481f9c524b1319b1b1aabbd1cc37a22000000098e47298637f4e52c9e0be30d3c0ea03887a3e1a261bc21f07e66c2dff89d47f40000000a457d9bb9326c2657c9717b948292f462f8ee4dae319d376d65fbb41a7050c112a9c7fa41327d7d72b536741684645dfab051966456d59806302a57a69065d37	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "460"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "147"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "47"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303c33fe6de3d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "783"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d4c54c6ee3d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://dropmefiles.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "748"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\dropmefiles.com\ = "122"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe

Modifies registry class 37 IoCs

Processes:

Nemesis.exeiexplore.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Nemesis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 54003100000000007b53ca48100044756d70657200003e0009000400efbe7b53c2487b53ca482e0000007dac0100000004000000000000000000000000000000c7800301440075006d00700065007200000016000000	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	Nemesis.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Nemesis.exeA.exeA.exe

pid	Process
2684	Nemesis.exe
932	A.exe
2684	Nemesis.exe
932	A.exe
2684	Nemesis.exe
2684	Nemesis.exe
2504	A.exe
2504	A.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Nemesis.exe

pid	Process
2684	Nemesis.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

7zFM.exeNemesis.exeA.exeA.exe7zG.exe

description	pid	Process
Token: SeRestorePrivilege	3708	7zFM.exe
Token: 35	3708	7zFM.exe
Token: SeSecurityPrivilege	3708	7zFM.exe
Token: SeDebugPrivilege	2684	Nemesis.exe
Token: SeDebugPrivilege	932	A.exe
Token: SeDebugPrivilege	2504	A.exe
Token: SeRestorePrivilege	476	7zG.exe
Token: 35	476	7zG.exe
Token: SeSecurityPrivilege	476	7zG.exe
Token: SeSecurityPrivilege	476	7zG.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

iexplore.exe7zFM.exeNemesis.exe7zG.exeIEXPLORE.EXE

pid	Process
2572	iexplore.exe
2572	iexplore.exe
2572	iexplore.exe
3708	7zFM.exe
3708	7zFM.exe
2684	Nemesis.exe
476	7zG.exe
2572	iexplore.exe
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

IEXPLORE.EXE

pid	Process
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

iexplore.exeIEXPLORE.EXEOpenWith.exeNemesis.exe

pid	Process
2572	iexplore.exe
2572	iexplore.exe
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1908	OpenWith.exe
2684	Nemesis.exe
2684	Nemesis.exe
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
2572	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2572 wrote to memory of 1076	2572	iexplore.exe	68
PID 2572 wrote to memory of 1076	2572	iexplore.exe	68
PID 2572 wrote to memory of 1076	2572	iexplore.exe	68

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dropmefiles.com/brqGr
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:82945 /prefetch:2
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2128

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Dumper.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3708

C:\Users\Admin\Desktop\Dumper\Nemesis.exe
"C:\Users\Admin\Desktop\Dumper\Nemesis.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Users\Admin\Desktop\Dumper\A.exe
"C:\Users\Admin\Desktop\Dumper\A.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Users\Admin\Desktop\Dumper\A.exe
"C:\Users\Admin\Desktop\Dumper\A.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap2026:66:7zEvent8551 -ad -saa -- "C:\Users\Admin\Desktop\Dumper\2"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71223C1EC1C8B4264AAD7D57D8EB4FDF

MD5
96d6190a7ded3dcdce2546f65765f536

SHA1
b4ea681121d0a2a4d31bc30b5ca044663082818b

SHA256
981aa3fa46c6259acd2d8a73415067ae7ebda21851dec9cf4a75e87f596354f7

SHA512
fce660176351d1131a06743b6972fbe969c7af6dff41edde9e3e786ef4fe2e894fc5ef606e9b0a01732582cb74b9549baca0b2fb37ae54d39d08f7a7e12a8ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12

MD5
079e1d109f11f6475db8d7a951c28100

SHA1
a4f9062593177a1be8962a860aadcb2d18cb6769

SHA256
620dc85751352a3324ad525ec624efa740280f33c55d28929c8b86a83c59fedd

SHA512
7aa450af62b785041c20a5e280225fed8f1af3dc00cf47406ce3b82328e7a1bd98740ce8e1b766cb2d6f3bcc31eb28be146e4d1b38340a943e95b80966aae414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71223C1EC1C8B4264AAD7D57D8EB4FDF

MD5
d041a6d9bbd757a9f451338e322ffd1b

SHA1
361e7b411b71ed3e9004a4e422fa643dca21329c

SHA256
361f86a8b725288e5260c18646c523ada90c338d8d92ecea21f5f14996f51290

SHA512
268f832bba5e7d81dbded93372d6b975ac8f281f5ad1e0068684022f9757ada2f2da5c7613118883084727fe8e034c67888cf7cefb9b3337c42db86370991d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12

MD5
133b9a4d5057c35c364c907c28237782

SHA1
20c89e8d2e0d2fc2879a339b41c237bdbd921384

SHA256
bbaf5053df409ca446c022c584257dc5de633a0010298d6683db51b7636a1430

SHA512
bd0cdace3daf1094e865b67e84ed81158cdb676726bb5e704ac71d11c2943c4e3402baa8130a101ded496c65f5fce05f2198b19af92304276653fecf32cdad23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\A.exe.log

MD5
5958251995526d87bfe8a905b76161bd

SHA1
8c80b9a10ecd44a82e34a14fba764b9c1ceef329

SHA256
608879cfb70b065676c9ab0ccff67f4793d289a9ea0dd7e69cefb9a43d6b8d46

SHA512
cf881c6847be76eceb7b29739542203e3a7ab8455ddbf85aa3652f4aafa9d1921f25e37e4eaf7ac9404b38d138c11c7424ca9ed144b7ea7c7d99e72c96d32e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LOEA0KPG\Dumper.rar.0r72ga7.partial

MD5
8b35432b24b1d5990634051631bf07f2

SHA1
6de89e5eb125fac158f62bf4eafe447d8266f1ac

SHA256
57ffd6eb72c70f8885aaf6afa5faf0b213bfec0b90340576c5375c9f94ab656e

SHA512
d3c110f33de96555a5aeb9103df8ded50823c497f11f6d9f239c8e354fba9a7f97d2da71f46013e31f325394bb2e3fc7a65ad06859e25972514d873d2b7242a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BJ08QS8C.cookie

MD5
42a30b7d753d6c5cc9f8c06069d1348a

SHA1
dad0e0099fe2d04ebd802ee02514822ee89fc2a9

SHA256
fd52b5c3f6095503246b25959717cbffab2b1d5a85fe77fb5ef73f410833bc94

SHA512
edb8fc975f8de0d94fb76888efd119815aee7fbc7fa5898ba2a1cd51b1634697f761e3a89c1226099ad365d259e5d8c5b19b3b786f3a816e7a7c39156c89d693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PD6IADY1.cookie

MD5
5ae72d9973ba3ab633612e2b2ac41651

SHA1
8756bfdbe42fe35747b132fa72c76c83a42a90a8

SHA256
a47be6d8a42cabba465b9e0a4998e0b4efadf41141b5e49bf6d2f912db33a621

SHA512
a95eacc63c46017e39ef0cbda5328d2db6bac75bb0483908eec99ebab615828445827fa2f580ba118c0e61f7239918f3274f9f346e0d2b399331658ae7f8f847

Download Submit
C:\Users\Admin\Desktop\Dumper\2.7z

MD5
05020ef2b80079cebdb96ccd53f0c182

SHA1
13379410b61ccb3ffe9d2b848a3b4c93c30f3f5b

SHA256
242d8dbf162eff7b51cb2e0aa7040049bb8ba267dbd1387b4d7c6b44cb339573

SHA512
6fc10c2d582586d772ac1831a8cf6124b7a0dc8e8f8f21ba7d1d86aacaf114f7e261587c9269255542e2d1a14f88f92241f9ef3e6f0791be58582d58a245fc1f

Download Submit
C:\Users\Admin\Desktop\Dumper\2\1.bin

MD5
9bba41b1c7755ff7940c07d11544b30d

SHA1
9c639c4a4c4af135d22a5be6cbe0a391b26c141a

SHA256
d3f3f8c7a8d5fa516df86aa2629d4d8568e79d95d76ff74e878b2ff28fae6831

SHA512
cc957d5b3f309280054753bf33a62ef59c911bc854e7c95478144597d282dfc39a6471143b72076c1b4a1cae847f3bff299e3b72bce671185174cd2f9fef4da5

Download Submit
C:\Users\Admin\Desktop\Dumper\A.exe

MD5
0779b1abd335e0db09f167e55624f1b7

SHA1
4cdd0ee3c066b83a35076a2560a43f2c73ccbb5a

SHA256
301f3d81802a8990a0b53dc69f4afcc2e863ef3c133c55737e0028bac0fbfcef

SHA512
adebd419b451833047318840c06a516ddb93c44e5709dad9cc4f4a22971871915be03e436718a8e2528b80e5bbaad50fc570488fce2e59323faf00f76ae6849a

Download Submit
C:\Users\Admin\Desktop\Dumper\A.exe

MD5
0779b1abd335e0db09f167e55624f1b7

SHA1
4cdd0ee3c066b83a35076a2560a43f2c73ccbb5a

SHA256
301f3d81802a8990a0b53dc69f4afcc2e863ef3c133c55737e0028bac0fbfcef

SHA512
adebd419b451833047318840c06a516ddb93c44e5709dad9cc4f4a22971871915be03e436718a8e2528b80e5bbaad50fc570488fce2e59323faf00f76ae6849a

Download Submit
C:\Users\Admin\Desktop\Dumper\A.exe

MD5
0779b1abd335e0db09f167e55624f1b7

SHA1
4cdd0ee3c066b83a35076a2560a43f2c73ccbb5a

SHA256
301f3d81802a8990a0b53dc69f4afcc2e863ef3c133c55737e0028bac0fbfcef

SHA512
adebd419b451833047318840c06a516ddb93c44e5709dad9cc4f4a22971871915be03e436718a8e2528b80e5bbaad50fc570488fce2e59323faf00f76ae6849a

Download Submit
C:\Users\Admin\Desktop\Dumper\MetroFramework.Fonts.dll

MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
C:\Users\Admin\Desktop\Dumper\MetroFramework.dll

MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
C:\Users\Admin\Desktop\Dumper\Nemesis.dll

MD5
cb105d3e5eb5a8f6ecedb6d8f4b757a1

SHA1
16f7830713eac8874bd04db23bed21c4197613ff

SHA256
55db85679a03270f13c82afac7c09d61743b087c7337297ffd77a27d393a5f8e

SHA512
d282bbc66eac7102cebf6bdefa1ed44874a3759f234116efb1f9bbaf1eab84f55cbab9b91fe76e64a5b332f5cdcef6658db6626b51a81179d72fc5a650ed9f07

Download Submit
C:\Users\Admin\Desktop\Dumper\Nemesis.exe

MD5
9635d5391c79b7dd9836211e7782bd95

SHA1
5b611f7014ec17a2ded672a7c9f9c3cf32ba88cf

SHA256
c794abac9761a004f8c2821fa745591d2bd641380fb17d020f6452f0a6b24328

SHA512
66ae80c2d89eb8cc865562423f84992d155f8204e19c8b079de4265a1550ad4e857debbb1ef0c32489f0049692a4be649b56291aa2064ab0f312ab5cc373366b

Download Submit
C:\Users\Admin\Desktop\Dumper\Nemesis.exe

MD5
9635d5391c79b7dd9836211e7782bd95

SHA1
5b611f7014ec17a2ded672a7c9f9c3cf32ba88cf

SHA256
c794abac9761a004f8c2821fa745591d2bd641380fb17d020f6452f0a6b24328

SHA512
66ae80c2d89eb8cc865562423f84992d155f8204e19c8b079de4265a1550ad4e857debbb1ef0c32489f0049692a4be649b56291aa2064ab0f312ab5cc373366b

Download Submit
C:\Users\Admin\Desktop\Dumper\Nemesis.exe.config

MD5
bc1bd48124e30ae229e8e737a4f7255f

SHA1
dccc5aa0c30844a71dc58a1d14466cc5c1304685

SHA256
bfc4546fb1d03580a6ab7d8e2cd4065fe8d1601e0fea2b0f487b8c5c4e26f70b

SHA512
a77e25fa230b5fefe8a1e56edd84c250df2d8255abf6cfa4730e1e839185d590789a5ec19cd995dba7052e64f69a090996e5b740584fd0ab27cbee78f9e7251b

Download Submit
C:\Users\Admin\Downloads\Dumper.rar.at1gmzy.partial

MD5
8b35432b24b1d5990634051631bf07f2

SHA1
6de89e5eb125fac158f62bf4eafe447d8266f1ac

SHA256
57ffd6eb72c70f8885aaf6afa5faf0b213bfec0b90340576c5375c9f94ab656e

SHA512
d3c110f33de96555a5aeb9103df8ded50823c497f11f6d9f239c8e354fba9a7f97d2da71f46013e31f325394bb2e3fc7a65ad06859e25972514d873d2b7242a5

Download Submit
\Users\Admin\Desktop\Dumper\Nemesis.dll

MD5
cb105d3e5eb5a8f6ecedb6d8f4b757a1

SHA1
16f7830713eac8874bd04db23bed21c4197613ff

SHA256
55db85679a03270f13c82afac7c09d61743b087c7337297ffd77a27d393a5f8e

SHA512
d282bbc66eac7102cebf6bdefa1ed44874a3759f234116efb1f9bbaf1eab84f55cbab9b91fe76e64a5b332f5cdcef6658db6626b51a81179d72fc5a650ed9f07

Download Submit
memory/932-244-0x0000025B00170000-0x0000025B00171000-memory.dmp

Filesize
4KB

Download
memory/932-243-0x0000025B002A0000-0x0000025B002A2000-memory.dmp

Filesize
8KB

Download
memory/1076-143-0x0000000000000000-mapping.dmp

Download
memory/2504-254-0x000002A0E8D40000-0x000002A0E8D42000-memory.dmp

Filesize
8KB

Download
memory/2572-140-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-118-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-153-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-154-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-158-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-159-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-160-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-166-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-167-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-168-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-169-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-170-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-171-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-172-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-150-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-174-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-175-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-178-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-179-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-148-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-147-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-144-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-145-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-184-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-141-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-152-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-139-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-138-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-137-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-135-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-134-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-119-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-120-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-122-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-132-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-131-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-123-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-124-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-130-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-128-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-127-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-126-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2572-125-0x00007FFB1C7D0000-0x00007FFB1C83B000-memory.dmp

Filesize
428KB

Download
memory/2684-246-0x0000021835E99000-0x0000021835E9F000-memory.dmp

Filesize
24KB

Download
memory/2684-226-0x0000021835E97000-0x0000021835E99000-memory.dmp

Filesize
8KB

Download
memory/2684-225-0x0000021835E95000-0x0000021835E97000-memory.dmp

Filesize
8KB

Download
memory/2684-222-0x0000021835E94000-0x0000021835E95000-memory.dmp

Filesize
4KB

Download
memory/2684-221-0x0000021835E92000-0x0000021835E94000-memory.dmp

Filesize
8KB

Download
memory/2684-220-0x0000021835E90000-0x0000021835E92000-memory.dmp

Filesize
8KB

Download