xred | 9deda7281dac54a2b7900300b1633a01da0dd33221f8c4a03c1691e871336483

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UNBANSEVER.exe
Size

1.5MB
MD5

b086631c257c5dc8eba94d46245385f7
SHA1

a6384ec1428329b3eab89e44ac79d23042984821
SHA256

9deda7281dac54a2b7900300b1633a01da0dd33221f8c4a03c1691e871336483
SHA512

f9b3df84bf5db8318795961341141d75b88dd8ca5dadf2214807c98ab7ff98760334e7073c2c38bd28159730d6f7d12a185245558de973a9a72397b25a3ef542
SSDEEP

24576:Ob4Ff/RLTbkY25ayxZ2i/UcgOpu+hcA+sbaNRBjv8oaa:W4Ff/RLTArbf2i7gwuqcA+sbkvhb

Score

10^/10

xred xworm backdoor discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

45.141.27.248:7777

45.141.26.194:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\svchost.exe	family_xworm
behavioral2/memory/4720-25-0x00000000006F0000-0x0000000000708000-memory.dmp	family_xworm
C:\ProgramData\SecurityHealthSystray.exe	family_xworm
behavioral2/memory/1172-176-0x0000000000880000-0x00000000008A2000-memory.dmp	family_xworm

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
732	powershell.exe
3516	powershell.exe
2640	powershell.exe
3704	powershell.exe
2244	powershell.exe
2300	powershell.exe
4240	powershell.exe
4548	powershell.exe
3764	powershell.exe
3432	powershell.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UNBANSEVER.exe._cache_UNBANSEVER.exeSynaptics.exe._cache_Synaptics.exesvchost.exeSecurityHealthSystray.exeUNBANSEVER.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	UNBANSEVER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	._cache_UNBANSEVER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	SecurityHealthSystray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	UNBANSEVER.exe

Drops startup file 4 IoCs

Processes:

svchost.exeSecurityHealthSystray.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registry.lnk	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registry.lnk	SecurityHealthSystray.exe

Executes dropped EXE 13 IoCs

Processes:

UNBANSEVER.exesvchost.exe._cache_UNBANSEVER.exeUNBANSEVER.exeSynaptics.exeSecurityHealthSystray.exe._cache_Synaptics.exeUNBANSEVER.exeSecurityHealthSystray.exeRegistrysvchost.exeRegistrysvchost.exe

pid	process
2268	UNBANSEVER.exe
4720	svchost.exe
4804	._cache_UNBANSEVER.exe
1484	UNBANSEVER.exe
2236	Synaptics.exe
1172	SecurityHealthSystray.exe
376	._cache_Synaptics.exe
1636	UNBANSEVER.exe
4536	SecurityHealthSystray.exe
4312	Registry
4556	svchost.exe
2196	Registry
2340	svchost.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

4720 svchost.exe

pid	process
4720	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

UNBANSEVER.exesvchost.exeSecurityHealthSystray.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	UNBANSEVER.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "C:\\ProgramData\\Registry"	SecurityHealthSystray.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
21	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

UNBANSEVER.exeSynaptics.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UNBANSEVER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4384	taskkill.exe
4892	taskkill.exe
2560	taskkill.exe
944	taskkill.exe
2728	taskkill.exe
2956	taskkill.exe
2108	taskkill.exe
2596	taskkill.exe
4772	taskkill.exe
924	taskkill.exe
1568	taskkill.exe
2632	taskkill.exe
4876	taskkill.exe
2256	taskkill.exe
4724	taskkill.exe
4556	taskkill.exe
2340	taskkill.exe
4464	taskkill.exe
2088	taskkill.exe
2988	taskkill.exe
2008	taskkill.exe
4816	taskkill.exe
3512	taskkill.exe
1752	taskkill.exe
4168	taskkill.exe
2476	taskkill.exe
468	taskkill.exe
968	taskkill.exe
4424	taskkill.exe
1032	taskkill.exe
968	taskkill.exe
4436	taskkill.exe
2168	taskkill.exe
2644	taskkill.exe
4804	taskkill.exe
2832	taskkill.exe
968	taskkill.exe
4408	taskkill.exe
2280	taskkill.exe
456	taskkill.exe
3484	taskkill.exe
432	taskkill.exe
4800	taskkill.exe
4432	taskkill.exe
4700	taskkill.exe
2860	taskkill.exe
628	taskkill.exe
3880	taskkill.exe
996	taskkill.exe
4436	taskkill.exe
1128	taskkill.exe
960	taskkill.exe
4224	taskkill.exe
968	taskkill.exe
3984	taskkill.exe
1144	taskkill.exe
1804	taskkill.exe
4492	taskkill.exe
3424	taskkill.exe
1932	taskkill.exe
996	taskkill.exe
3680	taskkill.exe
688	taskkill.exe
3400	taskkill.exe

Modifies registry class 2 IoCs

Processes:

UNBANSEVER.exeSynaptics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UNBANSEVER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3004 schtasks.exe
2000 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4768 EXCEL.EXE

pid	process
3004	schtasks.exe
2000	schtasks.exe

pid	process
4768	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exepowershell.exepowershell.exeSecurityHealthSystray.exepowershell.exepowershell.exesvchost.exe

pid	process
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
4548	powershell.exe
4548	powershell.exe
3764	powershell.exe
4548	powershell.exe
3764	powershell.exe
3764	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
732	powershell.exe
732	powershell.exe
732	powershell.exe
4720	svchost.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
1172	SecurityHealthSystray.exe
3516	powershell.exe
3516	powershell.exe
4240	powershell.exe
4240	powershell.exe
2872	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeSecurityHealthSystray.exeSecurityHealthSystray.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4720	svchost.exe
Token: SeDebugPrivilege	1172	SecurityHealthSystray.exe
Token: SeDebugPrivilege	4536	SecurityHealthSystray.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	1868	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	996	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

EXCEL.EXEsvchost.exeSecurityHealthSystray.exesvchost.exe

pid process

4768 EXCEL.EXE
4768 EXCEL.EXE
4768 EXCEL.EXE
4768 EXCEL.EXE
4720 svchost.exe
1172 SecurityHealthSystray.exe
2872 svchost.exe

pid	process
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4720	svchost.exe
1172	SecurityHealthSystray.exe
2872	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

UNBANSEVER.exeUNBANSEVER.exe._cache_UNBANSEVER.exeSynaptics.exe._cache_Synaptics.exeUNBANSEVER.execmd.execmd.execmd.execmd.execmd.exeUNBANSEVER.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 552 wrote to memory of 2268	552	UNBANSEVER.exe	UNBANSEVER.exe
PID 552 wrote to memory of 2268	552	UNBANSEVER.exe	UNBANSEVER.exe
PID 552 wrote to memory of 2268	552	UNBANSEVER.exe	UNBANSEVER.exe
PID 552 wrote to memory of 4720	552	UNBANSEVER.exe	svchost.exe
PID 552 wrote to memory of 4720	552	UNBANSEVER.exe	svchost.exe
PID 2268 wrote to memory of 4804	2268	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 2268 wrote to memory of 4804	2268	UNBANSEVER.exe	._cache_UNBANSEVER.exe
PID 4804 wrote to memory of 1484	4804	._cache_UNBANSEVER.exe	UNBANSEVER.exe
PID 4804 wrote to memory of 1484	4804	._cache_UNBANSEVER.exe	UNBANSEVER.exe
PID 2268 wrote to memory of 2236	2268	UNBANSEVER.exe	Synaptics.exe
PID 2268 wrote to memory of 2236	2268	UNBANSEVER.exe	Synaptics.exe
PID 2268 wrote to memory of 2236	2268	UNBANSEVER.exe	Synaptics.exe
PID 4804 wrote to memory of 1172	4804	._cache_UNBANSEVER.exe	SecurityHealthSystray.exe
PID 4804 wrote to memory of 1172	4804	._cache_UNBANSEVER.exe	SecurityHealthSystray.exe
PID 2236 wrote to memory of 376	2236	Synaptics.exe	._cache_Synaptics.exe
PID 2236 wrote to memory of 376	2236	Synaptics.exe	._cache_Synaptics.exe
PID 376 wrote to memory of 1636	376	._cache_Synaptics.exe	UNBANSEVER.exe
PID 376 wrote to memory of 1636	376	._cache_Synaptics.exe	UNBANSEVER.exe
PID 376 wrote to memory of 4536	376	._cache_Synaptics.exe	cmd.exe
PID 376 wrote to memory of 4536	376	._cache_Synaptics.exe	cmd.exe
PID 1484 wrote to memory of 2928	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 2928	1484	UNBANSEVER.exe	cmd.exe
PID 2928 wrote to memory of 2832	2928	cmd.exe	taskkill.exe
PID 2928 wrote to memory of 2832	2928	cmd.exe	taskkill.exe
PID 1484 wrote to memory of 3812	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 3812	1484	UNBANSEVER.exe	cmd.exe
PID 3812 wrote to memory of 4384	3812	cmd.exe	taskkill.exe
PID 3812 wrote to memory of 4384	3812	cmd.exe	taskkill.exe
PID 1484 wrote to memory of 2396	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 2396	1484	UNBANSEVER.exe	cmd.exe
PID 2396 wrote to memory of 2088	2396	cmd.exe	taskkill.exe
PID 2396 wrote to memory of 2088	2396	cmd.exe	taskkill.exe
PID 1484 wrote to memory of 4796	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 4796	1484	UNBANSEVER.exe	cmd.exe
PID 4796 wrote to memory of 1144	4796	cmd.exe	taskkill.exe
PID 4796 wrote to memory of 1144	4796	cmd.exe	taskkill.exe
PID 1484 wrote to memory of 1776	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 1776	1484	UNBANSEVER.exe	cmd.exe
PID 1776 wrote to memory of 1804	1776	cmd.exe	taskkill.exe
PID 1776 wrote to memory of 1804	1776	cmd.exe	taskkill.exe
PID 1636 wrote to memory of 2776	1636	UNBANSEVER.exe	cmd.exe
PID 1636 wrote to memory of 2776	1636	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 3608	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 3608	1484	UNBANSEVER.exe	cmd.exe
PID 2776 wrote to memory of 4876	2776	cmd.exe	cmd.exe
PID 2776 wrote to memory of 4876	2776	cmd.exe	cmd.exe
PID 3608 wrote to memory of 1868	3608	cmd.exe	Conhost.exe
PID 3608 wrote to memory of 1868	3608	cmd.exe	Conhost.exe
PID 1484 wrote to memory of 1932	1484	UNBANSEVER.exe	taskkill.exe
PID 1484 wrote to memory of 1932	1484	UNBANSEVER.exe	taskkill.exe
PID 1636 wrote to memory of 4088	1636	UNBANSEVER.exe	cmd.exe
PID 1636 wrote to memory of 4088	1636	UNBANSEVER.exe	cmd.exe
PID 1932 wrote to memory of 2988	1932	cmd.exe	taskkill.exe
PID 1932 wrote to memory of 2988	1932	cmd.exe	taskkill.exe
PID 4088 wrote to memory of 628	4088	cmd.exe	taskkill.exe
PID 4088 wrote to memory of 628	4088	cmd.exe	taskkill.exe
PID 1484 wrote to memory of 328	1484	UNBANSEVER.exe	cmd.exe
PID 1484 wrote to memory of 328	1484	UNBANSEVER.exe	cmd.exe
PID 1636 wrote to memory of 1988	1636	UNBANSEVER.exe	cmd.exe
PID 1636 wrote to memory of 1988	1636	UNBANSEVER.exe	cmd.exe
PID 328 wrote to memory of 2476	328	cmd.exe	taskkill.exe
PID 328 wrote to memory of 2476	328	cmd.exe	taskkill.exe
PID 1988 wrote to memory of 2256	1988	cmd.exe	taskkill.exe
PID 1988 wrote to memory of 2256	1988	cmd.exe	taskkill.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UNBANSEVER.exe
"C:\Users\Admin\AppData\Local\Temp\UNBANSEVER.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe
  "C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\ProgramData\UNBANSEVER.exe
      "C:\ProgramData\UNBANSEVER.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RiotClienServices.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RiotClienServices.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im vgtray.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3812
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vgtray.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumperClient.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3608
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:328
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
        5⤵
        
        PID:4052
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ProcessHacker.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
        5⤵
        
        PID:2392
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
        5⤵
        
        PID:1876
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
        5⤵
        
        PID:1760
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Wireshark.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
        5⤵
        
        PID:432
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Fiddler.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
        5⤵
        
        PID:4040
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FiddlerEverywhere.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
        5⤵
        
        PID:3804
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
        5⤵
        
        PID:4312
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
        5⤵
        
        PID:3608
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos32.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
        5⤵
        
        PID:3244
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im de4dot.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
        5⤵
        
        PID:1612
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Cheat Engine.exe
        6⤵
        Kills process with taskkill
        
        PID:996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        5⤵
        
        PID:1892
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        
        PID:2280
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
        5⤵
        
        PID:1900
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
        5⤵
        
        PID:2560
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-i386.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        5⤵
        
        PID:3484
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
        5⤵
        
        PID:4224
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-i386.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
        5⤵
        
        PID:4516
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
        6⤵
        Kills process with taskkill
        
        PID:3880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        5⤵
        
        PID:4916
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        5⤵
        
        PID:2008
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
        5⤵
        
        PID:924
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x64dbg.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
        5⤵
        
        PID:3756
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x32dbg.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        5⤵
        
        PID:2996
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        5⤵
        
        PID:2776
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
        5⤵
        
        PID:4896
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Ida64.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        5⤵
        
        PID:8
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        6⤵
        Kills process with taskkill
        
        PID:4464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
        5⤵
        
        PID:3208
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg64.exe
        6⤵
        
        PID:540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
        5⤵
        
        PID:960
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg32.exe
        6⤵
        Kills process with taskkill
        
        PID:2632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:372
  - - C:\ProgramData\SecurityHealthSystray.exe
      "C:\ProgramData\SecurityHealthSystray.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Registry'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Registry'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Registry" /tr "C:\ProgramData\Registry"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2000
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4168
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\ProgramData\UNBANSEVER.exe
        
        "C:\ProgramData\UNBANSEVER.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RiotClienServices.exe >nul 2>&1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RiotClienServices.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im vgtray.exe >nul 2>&1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vgtray.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:5092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mafiaengine-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
        6⤵
        
        PID:112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumperClient.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        6⤵
        
        PID:2268
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        
        PID:2196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        6⤵
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
        6⤵
        
        PID:1164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ProcessHacker.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
        6⤵
        
        PID:2220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
        6⤵
        
        PID:4876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im idaq64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
        6⤵
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Wireshark.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
        6⤵
        
        PID:2008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Fiddler.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
        6⤵
        
        PID:428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FiddlerEverywhere.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
        6⤵
        
        PID:2124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
        6⤵
        
        PID:3976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
        6⤵
        
        PID:2556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Xenos32.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
        6⤵
        
        PID:4016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im de4dot.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
        6⤵
        
        PID:1864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Cheat Engine.exe
        7⤵
        Kills process with taskkill
        
        PID:2644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        6⤵
        
        PID:2748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:3824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
        6⤵
        
        PID:1548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
        6⤵
        
        PID:1760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MugenJinFuu-i386.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
        6⤵
        
        PID:3868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-x86_64.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
        6⤵
        
        PID:1568
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cheatengine-i386.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
        6⤵
        
        PID:2780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
        7⤵
        Kills process with taskkill
        
        PID:3400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
        6⤵
        
        PID:1112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im KsDumper.exe
        7⤵
        Kills process with taskkill
        
        PID:4224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        6⤵
        
        PID:1880
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        7⤵
        
        PID:4432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
        6⤵
        
        PID:3968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x64dbg.exe
        7⤵
        Kills process with taskkill
        
        PID:4700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
        6⤵
        
        PID:1376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im x32dbg.exe
        7⤵
        Kills process with taskkill
        
        PID:2728
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        6⤵
        
        PID:4536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerUI.exe
        7⤵
        Kills process with taskkill
        
        PID:1032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        6⤵
        
        PID:2928
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im HTTPDebuggerSvc.exe
        7⤵
        Kills process with taskkill
        
        PID:2340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
        6⤵
        
        PID:2996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Ida64.exe
        7⤵
        Kills process with taskkill
        
        PID:3984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
        6⤵
        
        PID:3600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OllyDbg.exe
        7⤵
        Kills process with taskkill
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
        6⤵
        
        PID:2776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg64.exe
        7⤵
        
        PID:2324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
        6⤵
        
        PID:3860
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Dbg32.exe
        7⤵
        Kills process with taskkill
        
        PID:4408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4464
    - - C:\ProgramData\SecurityHealthSystray.exe
        
        "C:\ProgramData\SecurityHealthSystray.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3004
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\system32\svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4240
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1244
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1688
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4076

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 330a2fe6eded3d037a367edd3b1741c8 szjVEGAdd0eWOt9tr1/YfQ.0.1.0.0.0
1⤵
PID:4892

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1880

C:\ProgramData\Registry
C:\ProgramData\Registry
1⤵
- Executes dropped EXE
PID:4312

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:4556

C:\ProgramData\Registry
C:\ProgramData\Registry
1⤵
- Executes dropped EXE
PID:2196

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SecurityHealthSystray.exe

Filesize
112KB

MD5
08cc682417292fe4a048e5e466b13a1b

SHA1
bd2feb697b639327de8eb67e6ac4957df8f3b7b3

SHA256
38182c14bb826f357f1348df2affc840df3173054347b4883b0e3ae18402448c

SHA512
f5c5c49e9d652bdc3d89912880c2eefa80cce28fc3ecb7e3bb267969bd6dc79a5c8e218c307c869df2e63c50bb97a37813e47c6a87170c83a1bae4f9bf538267

Download Submit
C:\ProgramData\UNBANSEVER.exe

Filesize
548KB

MD5
6c08ba3b33673a7979167a6138a42544

SHA1
a065fa0d2d8d1d82dbb6cd1e1b3c8be2a09c74d1

SHA256
bed8d059ed403a6ff674aee820d5b3b0df4e072d1e86d09af8b55703abe31038

SHA512
69ea45439d6a965758fe8e8bbe05f6d247231e72d98e7396a77f6958636b968eb43742dcc4a1be4a9f05e67a0b2c526c16e27b7e7c64ce8fafed7531d180c03e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cae60f0ddddac635da71bba775a2c5b4

SHA1
386f1a036af61345a7d303d45f5230e2df817477

SHA256
b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16

SHA512
28ed8a8bc132ef56971cfd7b517b17cdb74a7f8c247ef6bff232996210075e06aa58a415825a1e038cfb547ad3dc6882bf1ca1b68c5b360ef0512a1440850253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
da5c82b0e070047f7377042d08093ff4

SHA1
89d05987cd60828cca516c5c40c18935c35e8bd3

SHA256
77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

SHA512
7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
02a2671d70b929dbd5569c2bd1a484c7

SHA1
67e0ec31c410d2c93ee1b574761186605fd57aef

SHA256
3f2128ad886573eca13daad4451adc6b3215dbc900caa8bf4c9805642ae19396

SHA512
16ea64d33da95447d081e8534a023e0d6fd3786088540345e2fe11648af08b45fa11cbf9bcde4d23824330b61db172382e8eb0feebc553bb93fda1a81e31e34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
67e8893616f805af2411e2f4a1411b2a

SHA1
39bf1e1a0ddf46ce7c136972120f512d92827dcd

SHA256
ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31

SHA512
164e911a9935e75c8be1a6ec3d31199a16ba2a1064da6c09d771b2a38dd7fddd142301ef55d67d90f306d3a454a1ce7b72e129ea42e44500b9b8c623a8d98b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_UNBANSEVER.exe

Filesize
675KB

MD5
ed22ee40a790a5153cd085e9dbd7391f

SHA1
f4e4d5723b2402c9a1c972b2c40ce2311d10171e

SHA256
a4504aa12e11ba425fca91830b3bed4834dd44109a01d5ff8c75e110a482fcc5

SHA512
5cb1b65f1c7861f89f09fb35b0a3ce189f4ded76c952b60f4a5fdb7f6abca3268fa768a6576ff9f09d106e6ed0ba4391ddd9aabc684b7e3101f0fd64cdbcd5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9cIGzecv.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nw04g4o3.z5k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7797.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
C:\Users\Admin\AppData\Roaming\UNBANSEVER.exe

Filesize
1.4MB

MD5
539f768061ffc3f39075ae3e4442802a

SHA1
706043a7105c1409d0007cdf6334dc0e34a4dfd8

SHA256
2300047877eeecb89531c05ef2736f621df249feb44a3cd7321c56a8355f10a1

SHA512
bd6086b87a80e3e36941deda63bca0c8fcf8f25e295fb4c211ccf848edf05afe5176fd0b77f53f536706bcf5a0f229ee81b3a97ad46d5ea8c0a90be2eb47ad32

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
70KB

MD5
e9a629dd7b0accda9d7696fc15135663

SHA1
d3643c86610e441da6304670fe7e5c2d07d1a6df

SHA256
bace1c7a8d5498687db5abc129d37373a918d5bda3ef11b94f21b3807887e799

SHA512
cceadc67f570e0165b0925b450e06eac2c46552e0b646a761862f5e6290fbdd727b84b41ca23470edf42da623643f29c58ea5a01bcf084f4488476ecace144d6

Download Submit
memory/552-1-0x0000000000B70000-0x0000000000CF0000-memory.dmp

Filesize
1.5MB

Download
memory/552-0-0x00007FFAEEA33000-0x00007FFAEEA35000-memory.dmp

Filesize
8KB

Download
memory/1172-176-0x0000000000880000-0x00000000008A2000-memory.dmp

Filesize
136KB

Download
memory/1244-374-0x000002421F570000-0x000002421F584000-memory.dmp

Filesize
80KB

Download
memory/2236-357-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/2236-400-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/2268-27-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/2268-174-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/2640-258-0x000001F85E580000-0x000001F85E5A2000-memory.dmp

Filesize
136KB

Download
memory/2872-371-0x000001FC95090000-0x000001FC950A5000-memory.dmp

Filesize
84KB

Download
memory/4720-370-0x000000001DA60000-0x000000001DAA2000-memory.dmp

Filesize
264KB

Download
memory/4720-26-0x00007FFAEEA30000-0x00007FFAEF4F1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-25-0x00000000006F0000-0x0000000000708000-memory.dmp

Filesize
96KB

Download
memory/4720-356-0x00007FFAEEA30000-0x00007FFAEF4F1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-434-0x000000001C800000-0x000000001C83A000-memory.dmp

Filesize
232KB

Download
memory/4768-247-0x00007FFACA700000-0x00007FFACA710000-memory.dmp

Filesize
64KB

Download
memory/4768-239-0x00007FFACC9F0000-0x00007FFACCA00000-memory.dmp

Filesize
64KB

Download
memory/4768-246-0x00007FFACA700000-0x00007FFACA710000-memory.dmp

Filesize
64KB

Download
memory/4768-238-0x00007FFACC9F0000-0x00007FFACCA00000-memory.dmp

Filesize
64KB

Download
memory/4768-242-0x00007FFACC9F0000-0x00007FFACCA00000-memory.dmp

Filesize
64KB

Download
memory/4768-240-0x00007FFACC9F0000-0x00007FFACCA00000-memory.dmp

Filesize
64KB

Download
memory/4768-241-0x00007FFACC9F0000-0x00007FFACCA00000-memory.dmp

Filesize
64KB

Download
memory/4804-97-0x0000000000EF0000-0x0000000000FA0000-memory.dmp

Filesize
704KB

Download