fa31734c4a27cb245c57d4ea9e68271714e10aea39a39ec849c29933cbd37e62

Analysis

max time kernel
186s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CG_Loader.exe
Size

3.7MB
MD5

376ddb3002bdde090c62b900a040437c
SHA1

97e44c84d2a12730c1ca19b6bfefbb9e11a7e8bb
SHA256

fa31734c4a27cb245c57d4ea9e68271714e10aea39a39ec849c29933cbd37e62
SHA512

669ed5461a9887e09c086146f56e2f129cad5c21699b2769231ff123af0449b10ef0888913c6bf3c4997a2038b900017a1f9aace531f8ae4b0daa54d9af57b06
SSDEEP

98304:Wxp8jKhbUiGEHmx0/cZ3uFtffOW9Ixb7JXTh:WxbhUiGWJ0EFtffA1D

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts.ics	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File created	C:\Windows\system32\Drivers\comrdb.sys	TJTACADN.dll

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\comrdb\ImagePath = "\\SystemRoot\\system32\\drivers\\comrdb.sys"	TJTACADN.dll

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	CG_Loader.exe

Executes dropped EXE 9 IoCs

pid	Process
3424	TJTACADN.dll
1520	TJTACADN.dll
4484	TJTACADN.dll
5480	TJTACADN.dll
5540	TJTACADN.dll
5616	TJTACADN.dll
5720	TJTACADN.dll
5844	TJTACADN.dll
5888	TJTACADN.dll

Loads dropped DLL 1 IoCs

pid	Process
2080	CG_Loader.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023273-18.dat	upx
behavioral2/files/0x0008000000023273-19.dat	upx
behavioral2/memory/3424-20-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/memory/3424-21-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-22.dat	upx
behavioral2/memory/1520-38-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-81.dat	upx
behavioral2/memory/4484-89-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/memory/4484-173-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-174.dat	upx
behavioral2/memory/5480-175-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/memory/5480-177-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-181.dat	upx
behavioral2/memory/5540-182-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-183.dat	upx
behavioral2/memory/5616-184-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/memory/5616-186-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-192.dat	upx
behavioral2/memory/5720-193-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-194.dat	upx
behavioral2/memory/5844-195-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx
behavioral2/files/0x0008000000023273-196.dat	upx
behavioral2/memory/5888-197-0x0000000000580000-0x0000000000DC8000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\TJTACADN.dll	CG_Loader.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1892	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5940	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2588	ipconfig.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e16764fc	TJTACADN.dll

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2080	CG_Loader.exe
2080	CG_Loader.exe
1520	TJTACADN.dll
1520	TJTACADN.dll
2324	msedge.exe
2324	msedge.exe
4408	msedge.exe
4408	msedge.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe
2080	CG_Loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
4484	TJTACADN.dll

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	CG_Loader.exe
Token: SeIncreaseQuotaPrivilege	3424	TJTACADN.dll
Token: SeSecurityPrivilege	3424	TJTACADN.dll
Token: SeTakeOwnershipPrivilege	3424	TJTACADN.dll
Token: SeLoadDriverPrivilege	3424	TJTACADN.dll
Token: SeSystemProfilePrivilege	3424	TJTACADN.dll
Token: SeSystemtimePrivilege	3424	TJTACADN.dll
Token: SeProfSingleProcessPrivilege	3424	TJTACADN.dll
Token: SeIncBasePriorityPrivilege	3424	TJTACADN.dll
Token: SeCreatePagefilePrivilege	3424	TJTACADN.dll
Token: SeBackupPrivilege	3424	TJTACADN.dll
Token: SeRestorePrivilege	3424	TJTACADN.dll
Token: SeShutdownPrivilege	3424	TJTACADN.dll
Token: SeDebugPrivilege	3424	TJTACADN.dll
Token: SeSystemEnvironmentPrivilege	3424	TJTACADN.dll
Token: SeChangeNotifyPrivilege	3424	TJTACADN.dll
Token: SeRemoteShutdownPrivilege	3424	TJTACADN.dll
Token: SeUndockPrivilege	3424	TJTACADN.dll
Token: SeManageVolumePrivilege	3424	TJTACADN.dll
Token: SeImpersonatePrivilege	3424	TJTACADN.dll
Token: SeCreateGlobalPrivilege	3424	TJTACADN.dll
Token: 33	3424	TJTACADN.dll
Token: 34	3424	TJTACADN.dll
Token: 35	3424	TJTACADN.dll
Token: 36	3424	TJTACADN.dll
Token: SeIncreaseQuotaPrivilege	1520	TJTACADN.dll
Token: SeSecurityPrivilege	1520	TJTACADN.dll
Token: SeTakeOwnershipPrivilege	1520	TJTACADN.dll
Token: SeLoadDriverPrivilege	1520	TJTACADN.dll
Token: SeSystemProfilePrivilege	1520	TJTACADN.dll
Token: SeSystemtimePrivilege	1520	TJTACADN.dll
Token: SeProfSingleProcessPrivilege	1520	TJTACADN.dll
Token: SeIncBasePriorityPrivilege	1520	TJTACADN.dll
Token: SeCreatePagefilePrivilege	1520	TJTACADN.dll
Token: SeBackupPrivilege	1520	TJTACADN.dll
Token: SeRestorePrivilege	1520	TJTACADN.dll
Token: SeShutdownPrivilege	1520	TJTACADN.dll
Token: SeDebugPrivilege	1520	TJTACADN.dll
Token: SeSystemEnvironmentPrivilege	1520	TJTACADN.dll
Token: SeChangeNotifyPrivilege	1520	TJTACADN.dll
Token: SeRemoteShutdownPrivilege	1520	TJTACADN.dll
Token: SeUndockPrivilege	1520	TJTACADN.dll
Token: SeManageVolumePrivilege	1520	TJTACADN.dll
Token: SeImpersonatePrivilege	1520	TJTACADN.dll
Token: SeCreateGlobalPrivilege	1520	TJTACADN.dll
Token: 33	1520	TJTACADN.dll
Token: 34	1520	TJTACADN.dll
Token: 35	1520	TJTACADN.dll
Token: 36	1520	TJTACADN.dll
Token: SeIncreaseQuotaPrivilege	4484	TJTACADN.dll
Token: SeSecurityPrivilege	4484	TJTACADN.dll
Token: SeTakeOwnershipPrivilege	4484	TJTACADN.dll
Token: SeLoadDriverPrivilege	4484	TJTACADN.dll
Token: SeSystemProfilePrivilege	4484	TJTACADN.dll
Token: SeSystemtimePrivilege	4484	TJTACADN.dll
Token: SeProfSingleProcessPrivilege	4484	TJTACADN.dll
Token: SeIncBasePriorityPrivilege	4484	TJTACADN.dll
Token: SeCreatePagefilePrivilege	4484	TJTACADN.dll
Token: SeBackupPrivilege	4484	TJTACADN.dll
Token: SeRestorePrivilege	4484	TJTACADN.dll
Token: SeShutdownPrivilege	4484	TJTACADN.dll
Token: SeDebugPrivilege	4484	TJTACADN.dll
Token: SeSystemEnvironmentPrivilege	4484	TJTACADN.dll
Token: SeChangeNotifyPrivilege	4484	TJTACADN.dll

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1520	TJTACADN.dll

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1192	2080	CG_Loader.exe	93
PID 2080 wrote to memory of 1192	2080	CG_Loader.exe	93
PID 2080 wrote to memory of 1192	2080	CG_Loader.exe	93
PID 1192 wrote to memory of 2400	1192	cmd.exe	95
PID 1192 wrote to memory of 2400	1192	cmd.exe	95
PID 1192 wrote to memory of 2400	1192	cmd.exe	95
PID 1192 wrote to memory of 3932	1192	cmd.exe	96
PID 1192 wrote to memory of 3932	1192	cmd.exe	96
PID 1192 wrote to memory of 3932	1192	cmd.exe	96
PID 1192 wrote to memory of 4156	1192	cmd.exe	97
PID 1192 wrote to memory of 4156	1192	cmd.exe	97
PID 1192 wrote to memory of 4156	1192	cmd.exe	97
PID 1192 wrote to memory of 400	1192	cmd.exe	98
PID 1192 wrote to memory of 400	1192	cmd.exe	98
PID 1192 wrote to memory of 400	1192	cmd.exe	98
PID 2080 wrote to memory of 4820	2080	CG_Loader.exe	100
PID 2080 wrote to memory of 4820	2080	CG_Loader.exe	100
PID 2080 wrote to memory of 4820	2080	CG_Loader.exe	100
PID 4820 wrote to memory of 3344	4820	cmd.exe	102
PID 4820 wrote to memory of 3344	4820	cmd.exe	102
PID 4820 wrote to memory of 3344	4820	cmd.exe	102
PID 2080 wrote to memory of 3992	2080	CG_Loader.exe	104
PID 2080 wrote to memory of 3992	2080	CG_Loader.exe	104
PID 2080 wrote to memory of 3992	2080	CG_Loader.exe	104
PID 2080 wrote to memory of 3848	2080	CG_Loader.exe	106
PID 2080 wrote to memory of 3848	2080	CG_Loader.exe	106
PID 2080 wrote to memory of 3848	2080	CG_Loader.exe	106
PID 3992 wrote to memory of 3192	3992	cmd.exe	108
PID 3992 wrote to memory of 3192	3992	cmd.exe	108
PID 3992 wrote to memory of 3192	3992	cmd.exe	108
PID 3848 wrote to memory of 3648	3848	cmd.exe	109
PID 3848 wrote to memory of 3648	3848	cmd.exe	109
PID 3848 wrote to memory of 3648	3848	cmd.exe	109
PID 3992 wrote to memory of 1892	3992	cmd.exe	110
PID 3992 wrote to memory of 1892	3992	cmd.exe	110
PID 3992 wrote to memory of 1892	3992	cmd.exe	110
PID 3848 wrote to memory of 3424	3848	cmd.exe	111
PID 3848 wrote to memory of 3424	3848	cmd.exe	111
PID 3848 wrote to memory of 3424	3848	cmd.exe	111
PID 3848 wrote to memory of 3444	3848	cmd.exe	114
PID 3848 wrote to memory of 3444	3848	cmd.exe	114
PID 3848 wrote to memory of 3444	3848	cmd.exe	114
PID 3848 wrote to memory of 1520	3848	cmd.exe	115
PID 3848 wrote to memory of 1520	3848	cmd.exe	115
PID 3848 wrote to memory of 1520	3848	cmd.exe	115
PID 2080 wrote to memory of 4408	2080	CG_Loader.exe	116
PID 2080 wrote to memory of 4408	2080	CG_Loader.exe	116
PID 4408 wrote to memory of 2184	4408	msedge.exe	117
PID 4408 wrote to memory of 2184	4408	msedge.exe	117
PID 3848 wrote to memory of 3864	3848	cmd.exe	137
PID 3848 wrote to memory of 3864	3848	cmd.exe	137
PID 3848 wrote to memory of 3864	3848	cmd.exe	137
PID 3848 wrote to memory of 3428	3848	cmd.exe	142
PID 3848 wrote to memory of 3428	3848	cmd.exe	142
PID 3848 wrote to memory of 3428	3848	cmd.exe	142
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120
PID 4408 wrote to memory of 1724	4408	msedge.exe	120

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3344	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f
    3⤵
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h -s -a C:\CG_Files
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h -s -a C:\CG_Files
    3⤵
    - Views/modifies file attributes
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|sc stop IObitUnlocker
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop IObitUnlocker
    3⤵
    - Launches sc.exe
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|%windir%\TJTACADN.dll /protection off & echo|%windir%\TJTACADN.dll /op:uninstall_app & echo y|cacls "%windir%\system32\drivers\etc\hosts" /P %username% & echo y|cacls "%windir%\system32\drivers\etc\hosts.ics" /P %username%:f & echo y|cacls "%windir%\system32\drivers\etc\hosts" /P alla:f & echo y|cacls "%windir%\system32\drivers\etc\hosts.ics" /P alla:f & echo y|cacls "%windir%\system32\drivers\etc\hosts" /P everyone:f & echo y|cacls "%windir%\system32\drivers\etc\hosts.ics" /P everyone:f & echo y|cacls "C:\CG_Files" /P alla:f & echo y|cacls "C:\CG_Files" /P %username%:f & echo y|cacls "C:\CG_Files" /P everyone:f & echo y|cacls "C:\CG_Files\*.*" /P alla:f & echo y|cacls "C:\CG_Files\*.*" /P %username%:f & echo y|cacls "C:\CG_Files\*.*" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P %username%:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P everyone:f & echo y|cacls "%windir%\system32\drivers\etc" /P %username%:f & echo y|cacls "%windir%\system32\drivers\etc" /P alla:f & echo y|cacls "%windir%\system32\drivers\etc" /P everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:3648
- - C:\Windows\TJTACADN.dll
    C:\Windows\TJTACADN.dll /protection off
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:3444
- - C:\Windows\TJTACADN.dll
    C:\Windows\TJTACADN.dll /op:uninstall_app
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts" /P Admin
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts.ics" /P Admin:f
    3⤵
    PID:628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts" /P alla:f
    3⤵
    PID:396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts.ics" /P alla:f
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:884
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts" /P everyone:f
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc\hosts.ics" /P everyone:f
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files" /P alla:f
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files" /P Admin:f
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files" /P everyone:f
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files\*.*" /P alla:f
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files\*.*" /P Admin:f
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\CG_Files\*.*" /P everyone:f
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P Admin:f
    3⤵
    PID:5504
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P Admin:f
    3⤵
    PID:5604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\System32\drivers\etc" /P Admin:f
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\System32\drivers\etc" /P alla:f
    3⤵
    PID:5852
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\System32\drivers\etc" /P everyone:f
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc" /P Admin:f
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5904
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc" /P alla:f
    3⤵
    PID:5936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\drivers\etc" /P everyone:f
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://href.li/?https://cheatglobal.com/ui/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b32d46f8,0x7ff9b32d4708,0x7ff9b32d4718
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3376 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8992183734583625589,6526781269005609662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:5972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|type "%appdata%\TJTACADN.txt" > "%windir%\system32\drivers\etc\hosts.ics" & echo|type "%appdata%\TJTACADN.txt" > "%windir%\system32\drivers\etc\hosts" & echo|ipconfig /flushdns
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Roaming\TJTACADN.txt" 1>"C:\Windows\system32\drivers\etc\hosts.ics""
    3⤵
    - Drops file in Drivers directory
    PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Roaming\TJTACADN.txt" 1>"C:\Windows\system32\drivers\etc\hosts""
    3⤵
    - Drops file in Drivers directory
    PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|"C:\Windows\TJTACADN.dll" /op:install_driver_registry & echo|"C:\Windows\TJTACADN.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only & echo|"C:\Windows\TJTACADN.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only & echo|"C:\Windows\TJTACADN.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled & echo|"C:\Windows\TJTACADN.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled & echo|"C:\Windows\TJTACADN.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe" Enabled & echo|"C:\Windows\TJTACADN.dll" /protection on & TIMEOUT /T 3 & echo|DEL /F /Q /A "%appdata%\TJTACADN.txt" & echo|RD /S /Q "%appdata%\TJTACADN.txt" & echo|DEL /F /Q /A "%windir%\TJTACADN.dll" & echo|RD /S /Q "%windir%\TJTACADN.dll"
  2⤵
  PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:396
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /op:install_driver_registry
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5484
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5544
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5540
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5612
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5848
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe" Enabled
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:5876
- - C:\Windows\TJTACADN.dll
    "C:\Windows\TJTACADN.dll" /protection on
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5888
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 3
    3⤵
    - Delays execution with timeout.exe
    PID:5940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" DEL /F /Q /A "C:\Users\Admin\AppData\Roaming\TJTACADN.txt" "
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" RD /S /Q "C:\Users\Admin\AppData\Roaming\TJTACADN.txt" "
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" DEL /F /Q /A "C:\Windows\TJTACADN.dll" "
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" RD /S /Q "C:\Windows\TJTACADN.dll""
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

Filesize
1KB

MD5
080d37ad0dd743bcf317f1a7dc5a11ea

SHA1
a57c6750602acd2b6f08c91bb1fb5fba39eeabd5

SHA256
5f906e69d7f8dbe935cac6f5dd723936708e85151efb36039c32d8f9be537def

SHA512
cca589d7d7f48a80bb90347d3d7553d7f3df066dadb8c096d387065820e189d51a912c3e9d354a0b3dbae0d26123d444be429bb32ecd98ee7b8330c177134603

Download Submit
C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

Filesize
1009B

MD5
7cf75d1bb73cc826c32cd7f8a10e3fc2

SHA1
5ccc5ea97a10244f149b66a4ad7f76debdb31efd

SHA256
d4acbd5ba2c48317516df9fed8f666de3dcda7ac4e188a2f3932417e65df149b

SHA512
18ab7b82da345f26a6f984a784e4448622c82f04bcacfcdca9599e02d064b6a7f20f31418eea41bedc9ea7949783f4cba5dc3fe4824c0cba7563d2d7f13637fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
620B

MD5
48a004c3b1384dcfca9ff813c2117aef

SHA1
3cbb148a674014b2a9069fe383e249c3c842a0c1

SHA256
52fc8de361489b242ca922831baecc6ab61bd5dd1cbe0c427d8df97617aa664c

SHA512
ef7cc850fd2ecdd7de3e02c0607cbadd3db3b3ba2feebd3143c2ed77f12341221bc30f0a77ca4f202f26e3d92df96d7c809e10638c9b02d70c011a4386250d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93b90955cdeb1c7cfd9cd8af9ac142d4

SHA1
95d3db180137b98ce981a64e2d64a91f3c8ae9ac

SHA256
95dca2876df1103121282da493f61881e4a3260ac94bfb07f7d38b09d988bd3a

SHA512
558d972c4fda257c757e4350660d29a8984d82bc05477f913b55176febe551de25fef6d0c02bd550369b059bdae16d5ba0ee475aba1a7f9a6c10dbe8ccbf28b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
963d51ce6a96e76c6138254966302b54

SHA1
32c978a2c89dd89cb29a676839095df4f35f90e7

SHA256
01536771e6fb234b932579b02863a8955c4282d904513f2b9bb26443a0cd16b2

SHA512
5edd23b60f23d24658b3081e73a8b3a358b08bc0f4ea445c632f870cd53e54b75e28325de796b79487bff4fc78fea293d8dcef5c2fcb585a270cf2777fcb0293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1ff21f122f67fe76eacfb75b5b5295f

SHA1
f1fc5a5ca41817ede6cfcfe9b9715dae9db66eb4

SHA256
e24bea2f4ab962d59437c5d4e46aecfdb1e96c15740826d74f4977b0bc853bf3

SHA512
4bc9c4eace73ec0fa32074223a92b17884e61aaa6f881af0a1d37d9acca44eddfae8c666c3afc94b5b417912747dfd2578930e0f99d584f26ef3bb129beaa71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
088d54d20b716c1f1308ec61f462263c

SHA1
6ea935f4de4ee345cac2977edf6452bd8aa86847

SHA256
92366177d07fc0aef3c6881013d864a2ec72caeae8e64314fd19aaf7d85ebf24

SHA512
2ae2c1a80b6aed4c4f71e4d8b69bdaabdbfb103acbe175e1c4f8ccba5b433f395658eeeae3bcbc2e6bd17f836f7c0153fcccd7969a1097509c895909aba49e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll

Filesize
77KB

MD5
69cdc240b3f2ad30b989e2c6cf705383

SHA1
07f3508c44d503d39fb4b7924ededaab2a9768be

SHA256
e42526f348de6a97f9746686e8409e396b42ce0c552dfdbe34855455c837b805

SHA512
25ea3582470e9fc42e7d4a8a652b8ba37b726cc03a1ab40dcac60b7c695bf9714f501be50b01775a6344d09856ca8d2b3a030f5a27efb34a7d9dc98a68eadbca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll

Filesize
77KB

MD5
69cdc240b3f2ad30b989e2c6cf705383

SHA1
07f3508c44d503d39fb4b7924ededaab2a9768be

SHA256
e42526f348de6a97f9746686e8409e396b42ce0c552dfdbe34855455c837b805

SHA512
25ea3582470e9fc42e7d4a8a652b8ba37b726cc03a1ab40dcac60b7c695bf9714f501be50b01775a6344d09856ca8d2b3a030f5a27efb34a7d9dc98a68eadbca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll

Filesize
77KB

MD5
69cdc240b3f2ad30b989e2c6cf705383

SHA1
07f3508c44d503d39fb4b7924ededaab2a9768be

SHA256
e42526f348de6a97f9746686e8409e396b42ce0c552dfdbe34855455c837b805

SHA512
25ea3582470e9fc42e7d4a8a652b8ba37b726cc03a1ab40dcac60b7c695bf9714f501be50b01775a6344d09856ca8d2b3a030f5a27efb34a7d9dc98a68eadbca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys

Filesize
65KB

MD5
47aa03a10ac3a407f8f30f1088edcbc9

SHA1
b5d78a1d3ae93bd343c6d65e64c0945d1d558758

SHA256
c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66

SHA512
3402ca68b00ffd9e2551f97b3895990ee0274f14f117505c3588ea76c716488860ac2da07c1d9275bbc43eb87b88893c52fb04d15f1afe7b7bf7d9a524961101

Download Submit
C:\Users\Admin\AppData\Roaming\TJTACADN.txt

Filesize
3KB

MD5
27d48a5a561e6fcf054322933b6c3fa8

SHA1
06d63ec608aa5febb7e60801bee56f1b25204a7c

SHA256
8730b54f7bf111cccf4743d5e7a67685f084d59c995170aa7c5d31fa3c90a820

SHA512
b81f07a88ac6266086d964612e24ae80e6fc5a46d6631cc25ae6d3b2598beea8e5d563b85bb45f065d8845012a181a483368047d9198a90a16ba5bff7818f468

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\TJTACADN.dll

Filesize
3.1MB

MD5
cd0f62e60245969c8f32684686969d9f

SHA1
72d70e6cbe9feb04ccebcaf17136cdbca2289c49

SHA256
295c6bd993a5ece971b032a3f5f7be68146172b9e1bda920e96fd3d4fc682e3f

SHA512
e29d76bc35c7209f9a81e9bbe1e178c5c725147a2b753f36d4b5f4e931df084d57822b8dcf9614f585824dc7c65754aa8543e621bce1e1d8bad617be357db951

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
27d48a5a561e6fcf054322933b6c3fa8

SHA1
06d63ec608aa5febb7e60801bee56f1b25204a7c

SHA256
8730b54f7bf111cccf4743d5e7a67685f084d59c995170aa7c5d31fa3c90a820

SHA512
b81f07a88ac6266086d964612e24ae80e6fc5a46d6631cc25ae6d3b2598beea8e5d563b85bb45f065d8845012a181a483368047d9198a90a16ba5bff7818f468

Download Submit
C:\Windows\system32\drivers\etc\hosts.ics

Filesize
3KB

MD5
27d48a5a561e6fcf054322933b6c3fa8

SHA1
06d63ec608aa5febb7e60801bee56f1b25204a7c

SHA256
8730b54f7bf111cccf4743d5e7a67685f084d59c995170aa7c5d31fa3c90a820

SHA512
b81f07a88ac6266086d964612e24ae80e6fc5a46d6631cc25ae6d3b2598beea8e5d563b85bb45f065d8845012a181a483368047d9198a90a16ba5bff7818f468

Download Submit
memory/1520-38-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/2080-14-0x00000000094C0000-0x00000000099EC000-memory.dmp

Filesize
5.2MB

Download
memory/2080-7-0x0000000006860000-0x000000000686A000-memory.dmp

Filesize
40KB

Download
memory/2080-4-0x00000000068F0000-0x000000000698C000-memory.dmp

Filesize
624KB

Download
memory/2080-3-0x0000000006440000-0x000000000684C000-memory.dmp

Filesize
4.0MB

Download
memory/2080-6-0x0000000006990000-0x0000000006A22000-memory.dmp

Filesize
584KB

Download
memory/2080-15-0x0000000009020000-0x000000000904C000-memory.dmp

Filesize
176KB

Download
memory/2080-0-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/2080-13-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2080-12-0x0000000006EB0000-0x0000000006EF4000-memory.dmp

Filesize
272KB

Download
memory/2080-11-0x0000000008450000-0x0000000008612000-memory.dmp

Filesize
1.8MB

Download
memory/2080-10-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2080-2-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2080-9-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/2080-1-0x0000000000390000-0x000000000073E000-memory.dmp

Filesize
3.7MB

Download
memory/2080-8-0x0000000006A30000-0x0000000006A86000-memory.dmp

Filesize
344KB

Download
memory/2080-50-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2080-5-0x0000000006F40000-0x00000000074E4000-memory.dmp

Filesize
5.6MB

Download
memory/3424-20-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/3424-21-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/4484-173-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/4484-89-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5480-177-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5480-175-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5540-182-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5616-186-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5616-184-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5720-193-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5844-195-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download
memory/5888-197-0x0000000000580000-0x0000000000DC8000-memory.dmp

Filesize
8.3MB

Download