xred | 9deda7281dac54a2b7900300b1633a01da0dd33221f8c4a03c1691e871336483

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UNBANSEVER.exe
Size

1.5MB
MD5

b086631c257c5dc8eba94d46245385f7
SHA1

a6384ec1428329b3eab89e44ac79d23042984821
SHA256

9deda7281dac54a2b7900300b1633a01da0dd33221f8c4a03c1691e871336483
SHA512

f9b3df84bf5db8318795961341141d75b88dd8ca5dadf2214807c98ab7ff98760334e7073c2c38bd28159730d6f7d12a185245558de973a9a72397b25a3ef542
SSDEEP

24576:Ob4Ff/RLTbkY25ayxZ2i/UcgOpu+hcA+sbaNRBjv8oaa:W4Ff/RLTArbf2i7gwuqcA+sbkvhb

Score

10^/10

xred xworm backdoor discovery execution macro persistence rat trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

45.141.27.248:7777

45.141.26.194:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2828-14-0x0000000000CA0000-0x0000000000CB8000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\svchost.exe	family_xworm
behavioral1/memory/3056-46-0x0000000000FF0000-0x0000000001012000-memory.dmp	family_xworm
C:\ProgramData\SecurityHealthSystray.exe	family_xworm
behavioral1/memory/2032-165-0x0000000000B60000-0x0000000000B82000-memory.dmp	family_xworm
behavioral1/memory/2624-211-0x00000000012C0000-0x00000000012E2000-memory.dmp	family_xworm

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
696	powershell.exe
2188	powershell.exe
2464	powershell.exe
2264	powershell.exe
2268	powershell.exe
2656	powershell.exe
2568	powershell.exe
2744	powershell.exe
1436	powershell.exe
284	powershell.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource
C:\Users\Admin\AppData\Local\Temp\hSdd1PO1.xlsm

Drops startup file 4 IoCs

Processes:

svchost.exeSecurityHealthSystray.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registry.lnk	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registry.lnk	SecurityHealthSystray.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 13 IoCs

Processes:

UNBANSEVER.exesvchost.exe._cache_UNBANSEVER.exeUNBANSEVER.exeSecurityHealthSystray.exeSynaptics.exe._cache_Synaptics.exeUNBANSEVER.exeSecurityHealthSystray.exeRegistrysvchost.exeRegistrysvchost.exe

pid	process
2704	UNBANSEVER.exe
2828	svchost.exe
2600	._cache_UNBANSEVER.exe
2584	UNBANSEVER.exe
3056	SecurityHealthSystray.exe
1624	Synaptics.exe
1712	._cache_Synaptics.exe
2288	UNBANSEVER.exe
1248	SecurityHealthSystray.exe
2032	Registry
996	svchost.exe
2624	Registry
2800	svchost.exe

Loads dropped DLL 8 IoCs

Processes:

UNBANSEVER.exe._cache_UNBANSEVER.exeSynaptics.exesvchost.exe

pid	process
2704	UNBANSEVER.exe
2704	UNBANSEVER.exe
2600	._cache_UNBANSEVER.exe
2704	UNBANSEVER.exe
2704	UNBANSEVER.exe
1624	Synaptics.exe
1624	Synaptics.exe
2828	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

UNBANSEVER.exesvchost.exeSecurityHealthSystray.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	UNBANSEVER.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "C:\\ProgramData\\Registry"	SecurityHealthSystray.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
9	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Synaptics.exeEXCEL.EXEUNBANSEVER.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UNBANSEVER.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1736	taskkill.exe
2372	taskkill.exe
1960	taskkill.exe
1604	taskkill.exe
372	taskkill.exe
696	taskkill.exe
2448	taskkill.exe
2632	taskkill.exe
1792	taskkill.exe
1488	taskkill.exe
2628	taskkill.exe
1404	taskkill.exe
968	taskkill.exe
976	taskkill.exe
1744	taskkill.exe
2892	taskkill.exe
2688	taskkill.exe
2416	taskkill.exe
2768	taskkill.exe
908	taskkill.exe
2364	taskkill.exe
1044	taskkill.exe
1436	taskkill.exe
2120	taskkill.exe
1968	taskkill.exe
2984	taskkill.exe
2972	taskkill.exe
1632	taskkill.exe
2208	taskkill.exe
1312	taskkill.exe
2464	taskkill.exe
1708	taskkill.exe
2712	taskkill.exe
1592	taskkill.exe
444	taskkill.exe
2364	taskkill.exe
2420	taskkill.exe
2256	taskkill.exe
2708	taskkill.exe
1532	taskkill.exe
268	taskkill.exe
1748	taskkill.exe
2736	taskkill.exe
544	taskkill.exe
588	taskkill.exe
1660	taskkill.exe
2148	taskkill.exe
2512	taskkill.exe
884	taskkill.exe
2624	taskkill.exe
1744	taskkill.exe
2068	taskkill.exe
588	taskkill.exe
2968	taskkill.exe
480	taskkill.exe
3016	taskkill.exe
2808	taskkill.exe
2148	taskkill.exe
2304	taskkill.exe
672	taskkill.exe
2700	taskkill.exe
1056	taskkill.exe
2564	taskkill.exe
1548	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1148 schtasks.exe
972 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2756 EXCEL.EXE

pid	process
1148	schtasks.exe
972	schtasks.exe

pid	process
2756	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exeSecurityHealthSystray.exepowershell.exepowershell.exesvchost.exe

pid	process
2264	powershell.exe
696	powershell.exe
2268	powershell.exe
2656	powershell.exe
2568	powershell.exe
2744	powershell.exe
2188	powershell.exe
1436	powershell.exe
2828	svchost.exe
3056	SecurityHealthSystray.exe
284	powershell.exe
2464	powershell.exe
2468	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeSecurityHealthSystray.exeSecurityHealthSystray.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2828	svchost.exe
Token: SeDebugPrivilege	3056	SecurityHealthSystray.exe
Token: SeDebugPrivilege	1248	SecurityHealthSystray.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	696	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	588	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	444	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	268	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	588	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXEsvchost.exeSecurityHealthSystray.exesvchost.exe

pid process

2756 EXCEL.EXE
2828 svchost.exe
3056 SecurityHealthSystray.exe
2468 svchost.exe

pid	process
2756	EXCEL.EXE
2828	svchost.exe
3056	SecurityHealthSystray.exe
2468	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

UNBANSEVER.exeUNBANSEVER.exe._cache_UNBANSEVER.exeSynaptics.exeUNBANSEVER.exe._cache_Synaptics.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1444 wrote to memory of 2704	1444	UNBANSEVER.exe	UNBANSEVER.exe
PID 1444 wrote to memory of 2704	1444	UNBANSEVER.exe	UNBANSEVER.exe
PID 1444 wrote to memory of 2704	1444	UNBANSEVER.exe	UNBANSEVER.exe
PID 1444 wrote to memory of 2704	1444	UNBANSEVER.exe	UNBANSEVER.exe
PID 1444 wrote to memory of 2828	1444	UNBANSEVER.exe	svchost.exe
PID 1444 wrote to memory of 2828	1444	UNBANSEVER.exe	svchost.exe
PID 1444 wrote to memory of 2828	1444	UNBANSEVER.exe	svchost.exe
PID 2704 wrote to memory of 2600	2704	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 2704 wrote to memory of 2600	2704	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 2704 wrote to memory of 2600	2704	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 2704 wrote to memory of 2600	2704	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 2600 wrote to memory of 2584	2600	._cache_UNBANSEVER.exe	UNBANSEVER.exe
PID 2600 wrote to memory of 2584	2600	._cache_UNBANSEVER.exe	UNBANSEVER.exe
PID 2600 wrote to memory of 2584	2600	._cache_UNBANSEVER.exe	UNBANSEVER.exe
PID 2600 wrote to memory of 3056	2600	._cache_UNBANSEVER.exe	SecurityHealthSystray.exe
PID 2600 wrote to memory of 3056	2600	._cache_UNBANSEVER.exe	SecurityHealthSystray.exe
PID 2600 wrote to memory of 3056	2600	._cache_UNBANSEVER.exe	SecurityHealthSystray.exe
PID 2704 wrote to memory of 1624	2704	UNBANSEVER.exe	Synaptics.exe
PID 2704 wrote to memory of 1624	2704	UNBANSEVER.exe	Synaptics.exe
PID 2704 wrote to memory of 1624	2704	UNBANSEVER.exe	Synaptics.exe
PID 2704 wrote to memory of 1624	2704	UNBANSEVER.exe	Synaptics.exe
PID 1624 wrote to memory of 1712	1624	Synaptics.exe	._cache_Synaptics.exe
PID 1624 wrote to memory of 1712	1624	Synaptics.exe	._cache_Synaptics.exe
PID 1624 wrote to memory of 1712	1624	Synaptics.exe	._cache_Synaptics.exe
PID 1624 wrote to memory of 1712	1624	Synaptics.exe	._cache_Synaptics.exe
PID 2584 wrote to memory of 2804	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2804	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2804	2584	UNBANSEVER.exe	cmd.exe
PID 1712 wrote to memory of 2288	1712	._cache_Synaptics.exe	UNBANSEVER.exe
PID 1712 wrote to memory of 2288	1712	._cache_Synaptics.exe	UNBANSEVER.exe
PID 1712 wrote to memory of 2288	1712	._cache_Synaptics.exe	UNBANSEVER.exe
PID 2804 wrote to memory of 2364	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 2364	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 2364	2804	cmd.exe	cmd.exe
PID 1712 wrote to memory of 1248	1712	._cache_Synaptics.exe	SecurityHealthSystray.exe
PID 1712 wrote to memory of 1248	1712	._cache_Synaptics.exe	SecurityHealthSystray.exe
PID 1712 wrote to memory of 1248	1712	._cache_Synaptics.exe	SecurityHealthSystray.exe
PID 2584 wrote to memory of 2120	2584	UNBANSEVER.exe	taskkill.exe
PID 2584 wrote to memory of 2120	2584	UNBANSEVER.exe	taskkill.exe
PID 2584 wrote to memory of 2120	2584	UNBANSEVER.exe	taskkill.exe
PID 2120 wrote to memory of 2208	2120	cmd.exe	taskkill.exe
PID 2120 wrote to memory of 2208	2120	cmd.exe	taskkill.exe
PID 2120 wrote to memory of 2208	2120	cmd.exe	taskkill.exe
PID 2584 wrote to memory of 3020	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 3020	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 3020	2584	UNBANSEVER.exe	cmd.exe
PID 3020 wrote to memory of 3016	3020	cmd.exe	cmd.exe
PID 3020 wrote to memory of 3016	3020	cmd.exe	cmd.exe
PID 3020 wrote to memory of 3016	3020	cmd.exe	cmd.exe
PID 2584 wrote to memory of 2436	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2436	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2436	2584	UNBANSEVER.exe	cmd.exe
PID 2436 wrote to memory of 2068	2436	cmd.exe	taskkill.exe
PID 2436 wrote to memory of 2068	2436	cmd.exe	taskkill.exe
PID 2436 wrote to memory of 2068	2436	cmd.exe	taskkill.exe
PID 2584 wrote to memory of 3052	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 3052	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 3052	2584	UNBANSEVER.exe	cmd.exe
PID 3052 wrote to memory of 1960	3052	cmd.exe	cmd.exe
PID 3052 wrote to memory of 1960	3052	cmd.exe	cmd.exe
PID 3052 wrote to memory of 1960	3052	cmd.exe	cmd.exe
PID 2584 wrote to memory of 2512	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2512	2584	UNBANSEVER.exe	cmd.exe
PID 2584 wrote to memory of 2512	2584	UNBANSEVER.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UNBANSEVER.exe
"C:\Users\Admin\AppData\Local\Temp\UNBANSEVER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe
  "C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\ProgramData\UNBANSEVER.exe
      "C:\ProgramData\UNBANSEVER.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RiotClienServices.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RiotClienServices.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im vgtray.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vgtray.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumperClient.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        5⤵
        
        PID:2512
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        
        PID:920
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        5⤵
        
        PID:1544
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
        5⤵
        
        PID:976
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ProcessHacker.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
        5⤵
        
        PID:1808
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
        5⤵
        
        PID:2264
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
        5⤵
        
        PID:1800
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Wireshark.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
        5⤵
        
        PID:2196
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Fiddler.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
        5⤵
        
        PID:2504
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FiddlerEverywhere.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
        5⤵
        
        PID:2816
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
        5⤵
        
        PID:1444
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
        5⤵
        
        PID:2588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos32.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
        5⤵
        
        PID:3060
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im de4dot.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
        5⤵
        
        PID:2572
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Cheat Engine.exe
        6⤵
        Kills process with taskkill
        
        PID:1592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        5⤵
        
        PID:2704
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        
        PID:2776
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        
        PID:700
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
        5⤵
        
        PID:2176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-i386.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        5⤵
        
        PID:3048
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
        5⤵
        
        PID:1960
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-i386.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
        5⤵
        
        PID:968
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
        6⤵
        Kills process with taskkill
        
        PID:2512
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        5⤵
        
        PID:1728
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        5⤵
        
        PID:2024
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
        5⤵
        
        PID:2428
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x64dbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
        5⤵
        
        PID:2292
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x32dbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        
        PID:2644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Kills process with taskkill
        
        PID:2968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        5⤵
        
        PID:2840
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
        5⤵
        
        PID:2216
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Ida64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        5⤵
        
        PID:2868
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
        5⤵
        
        PID:2612
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
        5⤵
        
        PID:2608
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg32.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:976
  - - C:\ProgramData\SecurityHealthSystray.exe
      "C:\ProgramData\SecurityHealthSystray.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Registry'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Registry'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1436
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Registry" /tr "C:\ProgramData\Registry"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:972
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\ProgramData\UNBANSEVER.exe
        
        "C:\ProgramData\UNBANSEVER.exe"
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RiotClienServices.exe >nul 2>&1
        6⤵
        
        PID:2888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RiotClienServices.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im vgtray.exe >nul 2>&1
        6⤵
        
        PID:1512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vgtray.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        
        PID:1664
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:2980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
        6⤵
        
        PID:1784
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumperClient.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        6⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        
        PID:2444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        6⤵
        
        PID:1396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
        6⤵
        
        PID:480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ProcessHacker.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
        6⤵
        
        PID:1680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
        6⤵
        
        PID:3040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
        6⤵
        
        PID:672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Wireshark.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:268
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
        6⤵
        
        PID:1064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Fiddler.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
        6⤵
        
        PID:2012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FiddlerEverywhere.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
        6⤵
        
        PID:2496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
        6⤵
        
        PID:2096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
        6⤵
        
        PID:2116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos32.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
        6⤵
        
        PID:2832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im de4dot.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
        6⤵
        
        PID:2872
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Cheat Engine.exe
        7⤵
        Kills process with taskkill
        
        PID:2420
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        6⤵
        
        PID:2980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:1784
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:1592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
        6⤵
        
        PID:2876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-i386.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        6⤵
        
        PID:2664
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
        6⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-i386.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
        6⤵
        
        PID:2084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
        7⤵
        Kills process with taskkill
        
        PID:2256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        6⤵
        
        PID:2364
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        6⤵
        
        PID:2272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
        6⤵
        
        PID:3016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x64dbg.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
        6⤵
        
        PID:1100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x32dbg.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        
        PID:1716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Kills process with taskkill
        
        PID:908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        6⤵
        
        PID:2204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        7⤵
        
        PID:1044
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
        6⤵
        
        PID:2512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Ida64.exe
        7⤵
        Kills process with taskkill
        
        PID:672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        6⤵
        
        PID:1776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        7⤵
        Kills process with taskkill
        
        PID:1548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
        6⤵
        
        PID:2448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg64.exe
        7⤵
        Kills process with taskkill
        
        PID:1744
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
        6⤵
        
        PID:1292
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg32.exe
        7⤵
        Kills process with taskkill
        
        PID:1404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:316
    - - C:\ProgramData\SecurityHealthSystray.exe
        
        "C:\ProgramData\SecurityHealthSystray.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2188
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1148
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2648
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\system32\svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2464

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "749259969184046259417270677481255719132-231307703955649924-1532387480748714147"
1⤵
PID:2876

C:\Windows\system32\taskeng.exe
taskeng.exe {2E7AB210-91AA-4FF1-9AB7-4BCA30580CAB} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
1⤵
PID:672
- C:\ProgramData\Registry
  C:\ProgramData\Registry
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\ProgramData\Registry
  C:\ProgramData\Registry
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SecurityHealthSystray.exe

Filesize
112KB

MD5
08cc682417292fe4a048e5e466b13a1b

SHA1
bd2feb697b639327de8eb67e6ac4957df8f3b7b3

SHA256
38182c14bb826f357f1348df2affc840df3173054347b4883b0e3ae18402448c

SHA512
f5c5c49e9d652bdc3d89912880c2eefa80cce28fc3ecb7e3bb267969bd6dc79a5c8e218c307c869df2e63c50bb97a37813e47c6a87170c83a1bae4f9bf538267

Download Submit
C:\ProgramData\UNBANSEVER.exe

Filesize
548KB

MD5
6c08ba3b33673a7979167a6138a42544

SHA1
a065fa0d2d8d1d82dbb6cd1e1b3c8be2a09c74d1

SHA256
bed8d059ed403a6ff674aee820d5b3b0df4e072d1e86d09af8b55703abe31038

SHA512
69ea45439d6a965758fe8e8bbe05f6d247231e72d98e7396a77f6958636b968eb43742dcc4a1be4a9f05e67a0b2c526c16e27b7e7c64ce8fafed7531d180c03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hSdd1PO1.xlsm

Filesize
25KB

MD5
1ba7a1cad99a06ce4349d9eae461d674

SHA1
20e15766d733d21aa6d2a03a4b938dbd42f2ef39

SHA256
78442663ca4a5996dcd85bdbf3ab2602cacf73bd601034cb053eba8d7d6ab98b

SHA512
b8cd837826939d025bbd2766113d691cecf8bff6b4d89403a425ae50186f5c47243dfbd9efd5c2bcc9b803e31ab935ece513039c197334cd23348b7500afb4ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\hSdd1PO1.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e6b771e2f80599f2ad9cd3d7d4b5925c

SHA1
5c88c6d6c678f60dee0c4f7652e5ee2efb8500e7

SHA256
d7a641c33879e07845e856f78459d139c33530f1e9e470dc31045ebc1e1f55bd

SHA512
2fbb08dfb93c1028d2eb53198bb915df59887d44b4fdb9c13b0418851fcc35b3037c9ffb83cb8a0bfbec6eb4fbf33a5672081604e760927ca09a7276ef7771cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ff6233d9a8ec436c63ae504f0e4a397d

SHA1
bc04411ee08f518c4f81bc28c72717b9814bcf39

SHA256
7ff215be6e589f4667d6d582b5c024c3e9d5e6c1e5313ed880bb8e12d8d86c66

SHA512
9c3b8f769ae76b39f33d61ba9d5ba97097f1fbe06784700281033b13aff99f6bca6f393ee4cd65fe3a0e183b288841fa0cd73dfd0e045ba6daa6fae70e677248

Download Submit
C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe

Filesize
1.4MB

MD5
539f768061ffc3f39075ae3e4442802a

SHA1
706043a7105c1409d0007cdf6334dc0e34a4dfd8

SHA256
2300047877eeecb89531c05ef2736f621df249feb44a3cd7321c56a8355f10a1

SHA512
bd6086b87a80e3e36941deda63bca0c8fcf8f25e295fb4c211ccf848edf05afe5176fd0b77f53f536706bcf5a0f229ee81b3a97ad46d5ea8c0a90be2eb47ad32

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
70KB

MD5
e9a629dd7b0accda9d7696fc15135663

SHA1
d3643c86610e441da6304670fe7e5c2d07d1a6df

SHA256
bace1c7a8d5498687db5abc129d37373a918d5bda3ef11b94f21b3807887e799

SHA512
cceadc67f570e0165b0925b450e06eac2c46552e0b646a761862f5e6290fbdd727b84b41ca23470edf42da623643f29c58ea5a01bcf084f4488476ecace144d6

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe

Filesize
675KB

MD5
ed22ee40a790a5153cd085e9dbd7391f

SHA1
f4e4d5723b2402c9a1c972b2c40ce2311d10171e

SHA256
a4504aa12e11ba425fca91830b3bed4834dd44109a01d5ff8c75e110a482fcc5

SHA512
5cb1b65f1c7861f89f09fb35b0a3ce189f4ded76c952b60f4a5fdb7f6abca3268fa768a6576ff9f09d106e6ed0ba4391ddd9aabc684b7e3101f0fd64cdbcd5a3

Download Submit
\Users\Admin\AppData\Local\Temp\tmp2701.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
memory/284-223-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/284-224-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1444-1-0x00000000010B0000-0x0000000001230000-memory.dmp

Filesize
1.5MB

Download
memory/1444-0-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

Filesize
4KB

Download
memory/1624-208-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/1624-160-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/1712-64-0x0000000001030000-0x00000000010E0000-memory.dmp

Filesize
704KB

Download
memory/2032-165-0x0000000000B60000-0x0000000000B82000-memory.dmp

Filesize
136KB

Download
memory/2264-116-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2264-115-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2268-128-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2268-127-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2464-231-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2464-230-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2600-34-0x0000000000E70000-0x0000000000F20000-memory.dmp

Filesize
704KB

Download
memory/2624-211-0x00000000012C0000-0x00000000012E2000-memory.dmp

Filesize
136KB

Download
memory/2648-171-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/2648-175-0x00000000020B0000-0x00000000020C4000-memory.dmp

Filesize
80KB

Download
memory/2648-172-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/2704-54-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/2756-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2828-170-0x0000000000C40000-0x0000000000C82000-memory.dmp

Filesize
264KB

Download
memory/2828-159-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-17-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-232-0x0000000002240000-0x000000000227A000-memory.dmp

Filesize
232KB

Download
memory/2828-14-0x0000000000CA0000-0x0000000000CB8000-memory.dmp

Filesize
96KB

Download
memory/3056-46-0x0000000000FF0000-0x0000000001012000-memory.dmp

Filesize
136KB

Download