allcome | 19b66b877aa9324a2e9a51d828e1cab41b553070d37729096c555a7f1810fbb3

Resubmissions

15-10-2023 15:31

231015-sx9b1aaf63 10

03-06-2023 11:19

230603-ne62psge66 10

12-04-2023 12:00

230412-n6gk5aca73 10

05-09-2022 16:12

220905-tny1cabffk 10

Analysis

max time kernel
137s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2023 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$RDUQK6W.exe
Size

10.5MB
MD5

4a5a3ad1c74f3f7d525e1c97995ca649
SHA1

cc0548dcbf4c0bc4489529e9148cf9f921485e84
SHA256

19b66b877aa9324a2e9a51d828e1cab41b553070d37729096c555a7f1810fbb3
SHA512

fbb94f6b670fbd6e32ac71b97cfe00d3c67a9747e1e4192ad1889bd8cf121b1b3bfe6e9fa0d4ba8634b5a8431b84c4ba7b3800bb6e128ce9ad759f952ac875b3
SSDEEP

196608:OXBAqsvidH8HkLOogdmCvl6SsT2bygeHHNc8zKiSKu5GjY2+rZvPTetsi0ERHblh:vidcEiJtNUEMH6kXYj5etb0qHblVFV

Score

10^/10

allcome colibri build1 evasion loader stealer trojan

Malware Config

Extracted

Family

allcome

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=Raqxnd

Wallets

D7pq84u7ke73RmCkRPc1z2nKBfmfPrYLxM

rEPri1dB2B6TxxzBw31ihKwGkEEE3ZCzH2

0x379844563B2947bCf8Ee7660d674E91704ba85cc

XqcVZ9pP5YyEwfQ4RkVXC5mWZgQBY3qNNz

TT5o47UN2jDfvmbv7EQm8NZ3xw7NcpKhKB

t1Qc898xYxqJ2Vsrd2X15EA3L2QzNrCdZ6W

GB3TZL2PBSQOQAEFU57JPIFAXG7R73ECOSQGT3XCDCOAUGUWUKWAVO7H

4AqLHHmtMTQRWomEbPd8yxFdEsZ5VMXy1MvwhG1TTWgcCbGzgaAcfkA54K45UbQXjtBa3UYhmr8vYaGNGAkVTfXCE5bbT12

qrkkg7692gv3fz407lt8zxdxtx2d4zuf2q204ykdzn

1NipSzEWByjXUarhF2p3qq51MVbnnoo6HZ

0x08BDb0e0339E7B9A725FD665Fc17B3AA3FF73BFc

LQtxqhZWP3EDi9n1tVdKNyZVR6wrFRr7hN

+79889916188

LP1oSHdQ3kdgrWnPvB5XtuBLZaMq9JMoWt

ltc1qq5k32ja0yun36ydqhv6edd8ydpmfkfy6g5e994

bc1qngt9pchlwak6rzc37ez05sfhzr8dnyupu7e769

bc1qnx4g8m8lctzxm5wlcfpw2ae8zkf6nxerdujzuu

89CBob8FyychG8inyWBBhqUxbPFGzVaWnBZRdeFi8V38XRRv312X6ViMPxCuom3GKk8hLFmZYmTPQ1qMmq6YY8rCNCDeubb

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Allcome
A clipbanker that supports stealing different cryptocurrency wallets and payment forms.
stealer allcome
Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	1160	schtasks.exe	41
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	1160	schtasks.exe	41

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5779722125.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	$RDUQK6W.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	XboxUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	5779722125.exe

Executes dropped EXE 8 IoCs

pid	Process
3684	5779722125.exe
2056	XboxUpdate.exe
4040	schtasks.exe
2724	Extreme Injector.exe
1440	tmp96C6.tmp.exe
3352	tmp982E.tmp.exe
2596	tmp96C6.tmp.exe
4796	tmp982E.tmp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 2596	1440	tmp96C6.tmp.exe	94
PID 3352 set thread context of 4796	3352	tmp982E.tmp.exe	98

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\unsecapp.exe	5779722125.exe
File created	C:\Program Files\Windows Multimedia Platform\29c1c3cc0f7685	5779722125.exe
File created	C:\Program Files (x86)\Google\Temp\9e8d7a4ca61bd9	5779722125.exe
File opened for modification	C:\Program Files\7-Zip\sihost.exe	5779722125.exe
File created	C:\Program Files\7-Zip\66fc9ff0ee96c2	5779722125.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\conhost.exe	5779722125.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\WmiPrvSE.exe	5779722125.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\winlogon.exe	5779722125.exe
File created	C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe	5779722125.exe
File created	C:\Program Files\7-Zip\sihost.exe	5779722125.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\24dbde2999530e	5779722125.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\24dbde2999530e	5779722125.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\cc11b995f2a76d	5779722125.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\WmiPrvSE.exe	5779722125.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\5779722125.exe	$RDUQK6W.exe
File created	C:\Windows\XboxUpdate.exe	$RDUQK6W.exe
File created	C:\Windows\Blitz.exe	$RDUQK6W.exe
File created	C:\Windows\IME\IMEJP\DICTS\spoolsv.exe	5779722125.exe
File created	C:\Windows\IME\IMEJP\DICTS\f3b6ecef712a24	5779722125.exe
File opened for modification	C:\Windows\5779722125.exe	5779722125.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	3684	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4996	schtasks.exe
2116	schtasks.exe
2200	schtasks.exe
4384	schtasks.exe
3104	schtasks.exe
3988	schtasks.exe
3804	schtasks.exe
1392	schtasks.exe
3196	schtasks.exe
3068	schtasks.exe
1972	schtasks.exe
3592	schtasks.exe
2976	schtasks.exe
3932	schtasks.exe
4260	schtasks.exe
5052	schtasks.exe
1652	schtasks.exe
3756	schtasks.exe
3116	schtasks.exe
4700	schtasks.exe
3756	schtasks.exe
1856	schtasks.exe
1852	schtasks.exe
3844	schtasks.exe
2172	schtasks.exe
4728	schtasks.exe
4580	schtasks.exe
2732	schtasks.exe
1636	schtasks.exe
4152	schtasks.exe
3668	schtasks.exe
3448	schtasks.exe
3936	schtasks.exe
4428	schtasks.exe
4040	schtasks.exe
4256	schtasks.exe
3164	schtasks.exe
3020	schtasks.exe
428	schtasks.exe
3292	schtasks.exe
4448	schtasks.exe
5088	schtasks.exe
3680	schtasks.exe
1080	schtasks.exe
1572	schtasks.exe
4868	schtasks.exe
1936	schtasks.exe
224	schtasks.exe
2668	schtasks.exe
4592	schtasks.exe
3136	schtasks.exe
3184	schtasks.exe
4028	schtasks.exe
392	schtasks.exe
3024	schtasks.exe
1120	schtasks.exe
1044	schtasks.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Extreme Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\NodeSlot = "6"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Extreme Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 19002f433a5c000000000000000000000000000000000000000000	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Extreme Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000020000000100000000000000ffffffff	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\MRUListEx = ffffffff	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Extreme Injector.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = 00000000ffffffff	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Extreme Injector.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2244	powershell.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
3684	5779722125.exe
2244	powershell.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe
3684	5779722125.exe
2056	XboxUpdate.exe
2056	XboxUpdate.exe
3684	5779722125.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	Extreme Injector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	XboxUpdate.exe
Token: SeDebugPrivilege	3684	5779722125.exe
Token: SeDebugPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	2724	Extreme Injector.exe
Token: 33	2724	Extreme Injector.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	Extreme Injector.exe
2724	Extreme Injector.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2244	4652	$RDUQK6W.exe	84
PID 4652 wrote to memory of 2244	4652	$RDUQK6W.exe	84
PID 4652 wrote to memory of 2244	4652	$RDUQK6W.exe	84
PID 4652 wrote to memory of 3684	4652	$RDUQK6W.exe	86
PID 4652 wrote to memory of 3684	4652	$RDUQK6W.exe	86
PID 4652 wrote to memory of 2056	4652	$RDUQK6W.exe	87
PID 4652 wrote to memory of 2056	4652	$RDUQK6W.exe	87
PID 4652 wrote to memory of 4040	4652	$RDUQK6W.exe	124
PID 4652 wrote to memory of 4040	4652	$RDUQK6W.exe	124
PID 4652 wrote to memory of 4040	4652	$RDUQK6W.exe	124
PID 4652 wrote to memory of 2724	4652	$RDUQK6W.exe	89
PID 4652 wrote to memory of 2724	4652	$RDUQK6W.exe	89
PID 2056 wrote to memory of 1440	2056	XboxUpdate.exe	90
PID 2056 wrote to memory of 1440	2056	XboxUpdate.exe	90
PID 2056 wrote to memory of 1440	2056	XboxUpdate.exe	90
PID 3684 wrote to memory of 3352	3684	5779722125.exe	92
PID 3684 wrote to memory of 3352	3684	5779722125.exe	92
PID 3684 wrote to memory of 3352	3684	5779722125.exe	92
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 1440 wrote to memory of 2596	1440	tmp96C6.tmp.exe	94
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98
PID 3352 wrote to memory of 4796	3352	tmp982E.tmp.exe	98

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5779722125.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$RDUQK6W.exe
"C:\Users\Admin\AppData\Local\Temp\$RDUQK6W.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAbQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAagBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AZABpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAbQByACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\5779722125.exe
  "C:\Windows\5779722125.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4796
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3684 -s 1284
    3⤵
    - Program crash
    PID:4328
- C:\Windows\XboxUpdate.exe
  "C:\Windows\XboxUpdate.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:2596
- C:\Windows\Blitz.exe
  "C:\Windows\Blitz.exe"
  2⤵
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Downloads\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57797221255" /sc MINUTE /mo 7 /tr "'C:\odt\5779722125.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57797221255" /sc MINUTE /mo 6 /tr "'C:\odt\5779722125.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5779722125" /sc ONLOGON /tr "'C:\odt\5779722125.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\locale\fi\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\fi\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Executes dropped EXE
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\locale\fi\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEJP\DICTS\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\IME\IMEJP\DICTS\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\IMEJP\DICTS\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\3D Objects\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\3D Objects\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\WinMSIPC\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\WinMSIPC\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Microsoft\WinMSIPC\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3684 -ip 3684
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe

Filesize
1.9MB

MD5
ec801a7d4b72a288ec6c207bb9ff0131

SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561

SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe

Filesize
1.9MB

MD5
ec801a7d4b72a288ec6c207bb9ff0131

SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561

SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe

Filesize
1.9MB

MD5
ec801a7d4b72a288ec6c207bb9ff0131

SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561

SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_op1lpa4f.g0i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96C6.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp982E.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Windows\5779722125.exe

Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\Windows\5779722125.exe

Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\Windows\5779722125.exe

Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\Windows\Blitz.exe

Filesize
461KB

MD5
9c30b653d66d104fa03e85c9c5987c19

SHA1
1db5a95ca0e2303bc7bc69ce1259e59594cbeb4d

SHA256
6f38484383e3301e91664d2cf8cfdc9347c37fa2c11e9c03838484745f6f1ba2

SHA512
464b6e92be6e4c0b74161a1d3eecccd766e4ced0c7940ab235cc96e80703b391cf56142c6c256d8fd45498949fde9f5cc5a8977d89752fac0cca133410c4744d

Download Submit
C:\Windows\Blitz.exe

Filesize
461KB

MD5
9c30b653d66d104fa03e85c9c5987c19

SHA1
1db5a95ca0e2303bc7bc69ce1259e59594cbeb4d

SHA256
6f38484383e3301e91664d2cf8cfdc9347c37fa2c11e9c03838484745f6f1ba2

SHA512
464b6e92be6e4c0b74161a1d3eecccd766e4ced0c7940ab235cc96e80703b391cf56142c6c256d8fd45498949fde9f5cc5a8977d89752fac0cca133410c4744d

Download Submit
C:\Windows\Blitz.exe

Filesize
461KB

MD5
9c30b653d66d104fa03e85c9c5987c19

SHA1
1db5a95ca0e2303bc7bc69ce1259e59594cbeb4d

SHA256
6f38484383e3301e91664d2cf8cfdc9347c37fa2c11e9c03838484745f6f1ba2

SHA512
464b6e92be6e4c0b74161a1d3eecccd766e4ced0c7940ab235cc96e80703b391cf56142c6c256d8fd45498949fde9f5cc5a8977d89752fac0cca133410c4744d

Download Submit
C:\Windows\XboxUpdate.exe

Filesize
2.4MB

MD5
9539d670b998aa46651b51d69123b909

SHA1
77c4912a7b67260c486fda2f93a3b98ecb5e7d65

SHA256
52712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669

SHA512
9352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa

Download Submit
C:\Windows\XboxUpdate.exe

Filesize
2.4MB

MD5
9539d670b998aa46651b51d69123b909

SHA1
77c4912a7b67260c486fda2f93a3b98ecb5e7d65

SHA256
52712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669

SHA512
9352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa

Download Submit
C:\Windows\XboxUpdate.exe

Filesize
2.4MB

MD5
9539d670b998aa46651b51d69123b909

SHA1
77c4912a7b67260c486fda2f93a3b98ecb5e7d65

SHA256
52712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669

SHA512
9352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa

Download Submit
memory/2056-271-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-280-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-690-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/2056-191-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-194-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-196-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-198-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-200-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-296-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-304-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-302-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-298-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-203-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-293-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-213-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-289-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-287-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-285-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-246-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-187-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-227-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-231-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-166-0x0000000000C80000-0x0000000000EF0000-memory.dmp

Filesize
2.4MB

Download
memory/2056-236-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-242-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-184-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-256-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-260-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-253-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-185-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-265-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-268-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-177-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/2056-273-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2056-275-0x000000001BF30000-0x000000001BFD2000-memory.dmp

Filesize
648KB

Download
memory/2244-386-0x00000000732B0000-0x00000000732FC000-memory.dmp

Filesize
304KB

Download
memory/2244-381-0x0000000006C40000-0x0000000006C72000-memory.dmp

Filesize
200KB

Download
memory/2244-537-0x00000000072B0000-0x00000000072B8000-memory.dmp

Filesize
32KB

Download
memory/2244-531-0x00000000072D0000-0x00000000072EA000-memory.dmp

Filesize
104KB

Download
memory/2244-383-0x00000000046E0000-0x00000000046F0000-memory.dmp

Filesize
64KB

Download
memory/2244-514-0x00000000071D0000-0x00000000071DE000-memory.dmp

Filesize
56KB

Download
memory/2244-450-0x0000000007210000-0x00000000072A6000-memory.dmp

Filesize
600KB

Download
memory/2244-431-0x0000000007010000-0x000000000701A000-memory.dmp

Filesize
40KB

Download
memory/2244-188-0x00000000046E0000-0x00000000046F0000-memory.dmp

Filesize
64KB

Download
memory/2244-422-0x0000000006F90000-0x0000000006FAA000-memory.dmp

Filesize
104KB

Download
memory/2244-419-0x00000000075D0000-0x0000000007C4A000-memory.dmp

Filesize
6.5MB

Download
memory/2244-219-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/2244-212-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/2244-190-0x00000000046E0000-0x00000000046F0000-memory.dmp

Filesize
64KB

Download
memory/2244-294-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/2244-400-0x0000000006250000-0x000000000626E000-memory.dmp

Filesize
120KB

Download
memory/2244-178-0x00000000046F0000-0x0000000004726000-memory.dmp

Filesize
216KB

Download
memory/2244-183-0x0000000004D60000-0x0000000005388000-memory.dmp

Filesize
6.2MB

Download
memory/2244-385-0x000000007EEF0000-0x000000007EF00000-memory.dmp

Filesize
64KB

Download
memory/2244-202-0x0000000004CB0000-0x0000000004CD2000-memory.dmp

Filesize
136KB

Download
memory/2596-257-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2596-283-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2724-192-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1438-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1439-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-313-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-221-0x000000001E7C0000-0x000000001E7D2000-memory.dmp

Filesize
72KB

Download
memory/2724-1437-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-182-0x0000000000FF0000-0x00000000011D6000-memory.dmp

Filesize
1.9MB

Download
memory/2724-247-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1436-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-226-0x000000001E920000-0x000000001E95C000-memory.dmp

Filesize
240KB

Download
memory/2724-1435-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1434-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1440-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2724-1089-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/3684-249-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-1433-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-164-0x0000000000300000-0x00000000008C2000-memory.dmp

Filesize
5.8MB

Download
memory/3684-1091-0x000000001C160000-0x000000001C260000-memory.dmp

Filesize
1024KB

Download
memory/3684-940-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-1292-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-942-0x000000001C160000-0x000000001C260000-memory.dmp

Filesize
1024KB

Download
memory/3684-1294-0x000000001C160000-0x000000001C260000-memory.dmp

Filesize
1024KB

Download
memory/3684-315-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-442-0x000000001C160000-0x000000001C260000-memory.dmp

Filesize
1024KB

Download
memory/3684-250-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-204-0x000000001B570000-0x000000001B5C0000-memory.dmp

Filesize
320KB

Download
memory/3684-180-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3684-279-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download