Overview

overview

10

Static

static

3

Extreme In...v3.exe

windows7-x64

10

Extreme In...v3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 14:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Extreme Injector v3.exe

  • Size

    1.4MB

  • MD5

    2290a5c6cfd6f8bd2e3ad188e7eafa05

  • SHA1

    1b863031e8556e48fa63d233b768148d87dda7c4

  • SHA256

    261d6fc361222284586e133e152797651ecde629ac3243cf47dba5af1fa4c3cc

  • SHA512

    13310057c8f3e54a5c5c06b5976e6b97d2930191ee6c432e59faaf561968e6e6fa261021ffd2a08b040340f05ae878d7e46fdea4127032fb51fb0b0b2bdd82d7

  • SSDEEP

    24576:PAOmi5Vm+lBnehvY2iPr93CeF1LH1Xt5QezP9tHtR9JSWmsMrlA18VnZAWQvKsoe:E4FdetMVCK1LVXXQezP3+Wgm18VeWouS

Score
10/10
umbraldiscoveryexecutionspywarestealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1330303031618834494/9EbwLYdGRckxpwmC1x4tuNXcnptDOj3OQ10dKAGSqevucBbQ362A75MKfWoz9gAFomh6

Signatures

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 19 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs
  • Looks up external IP address via web service 19 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 18 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 19 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:1680
            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4164
              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                7⤵
                  PID:3028
                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                    8⤵
                    • Checks computer location settings
                    PID:1476
                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                      9⤵
                      • Checks computer location settings
                      PID:2136
                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                        10⤵
                        • Checks computer location settings
                        PID:416
                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                          11⤵
                          • Checks computer location settings
                          PID:3728
                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                            12⤵
                            • Checks computer location settings
                            PID:4192
                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                              13⤵
                              • Checks computer location settings
                              PID:2296
                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                14⤵
                                • Checks computer location settings
                                PID:832
                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                  15⤵
                                  • Checks computer location settings
                                  PID:4460
                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                    16⤵
                                    • Checks computer location settings
                                    PID:2728
                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                      17⤵
                                      • Checks computer location settings
                                      PID:2384
                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                        18⤵
                                        • Checks computer location settings
                                        PID:2440
                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                          19⤵
                                          • Checks computer location settings
                                          PID:4288
                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                            20⤵
                                            • Checks computer location settings
                                            PID:3316
                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                              21⤵
                                              • Checks computer location settings
                                              PID:4164
                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                22⤵
                                                • Checks computer location settings
                                                PID:1960
                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  PID:4192
                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    PID:1496
                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:4808
                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:1936
                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          PID:352
                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            PID:3244
                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:1472
                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                PID:3120
                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  PID:4980
                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    PID:1096
                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                      33⤵
                                                                      • Checks computer location settings
                                                                      PID:2076
                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        PID:5108
                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          PID:1620
                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                            36⤵
                                                                            • Checks computer location settings
                                                                            PID:3336
                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                              37⤵
                                                                              • Checks computer location settings
                                                                              PID:4844
                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                PID:2388
                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                  39⤵
                                                                                  • Checks computer location settings
                                                                                  PID:960
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                    40⤵
                                                                                    • Checks computer location settings
                                                                                    PID:1844
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                      41⤵
                                                                                      • Checks computer location settings
                                                                                      PID:2128
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                        42⤵
                                                                                        • Checks computer location settings
                                                                                        PID:408
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                          43⤵
                                                                                          • Checks computer location settings
                                                                                          PID:2788
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                            44⤵
                                                                                            • Checks computer location settings
                                                                                            PID:3760
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                              45⤵
                                                                                              • Checks computer location settings
                                                                                              PID:1028
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                46⤵
                                                                                                • Checks computer location settings
                                                                                                PID:2192
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                  47⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:3984
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                    48⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:1528
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                      49⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:1276
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                        50⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:4712
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                          51⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:1612
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                            52⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:1172
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                              53⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:2444
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                54⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:4408
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                  55⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:1936
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                    56⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:3204
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                      57⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:220
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                        58⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:1484
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                          59⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:3280
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                            60⤵
                                                                                                                              PID:4448
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                61⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:3136
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                  62⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:1212
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:1980
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                      64⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:4272
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:1072
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                          66⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:3064
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                            67⤵
                                                                                                                                              PID:2916
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
                                                                                                                                                68⤵
                                                                                                                                                  PID:2924
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  68⤵
                                                                                                                                                    PID:4164
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  67⤵
                                                                                                                                                    PID:1360
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  66⤵
                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                  PID:4456
                                                                                                                                                  • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    67⤵
                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                    PID:1972
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                    67⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:1948
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                    67⤵
                                                                                                                                                      PID:4452
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      67⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:1524
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      67⤵
                                                                                                                                                        PID:4020
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" os get Caption
                                                                                                                                                        67⤵
                                                                                                                                                          PID:4092
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                          67⤵
                                                                                                                                                            PID:624
                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                            67⤵
                                                                                                                                                              PID:1608
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                              67⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:3960
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                          65⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2308
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        64⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1732
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      63⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3748
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    62⤵
                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3196
                                                                                                                                                    • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      63⤵
                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                      PID:1308
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                      63⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:640
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                      63⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:4808
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      63⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:2488
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      63⤵
                                                                                                                                                        PID:1948
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" os get Caption
                                                                                                                                                        63⤵
                                                                                                                                                          PID:1356
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                          63⤵
                                                                                                                                                            PID:540
                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                            63⤵
                                                                                                                                                              PID:1124
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                              63⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:3756
                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                              "wmic" path win32_VideoController get name
                                                                                                                                                              63⤵
                                                                                                                                                              • Detects videocard installed
                                                                                                                                                              PID:1360
                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                              63⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              PID:2740
                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                ping localhost
                                                                                                                                                                64⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:3912
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                          61⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2592
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        60⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1980
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      59⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4460
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    58⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4072
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  57⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4100
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                56⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1592
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                              55⤵
                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5016
                                                                                                                                              • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                56⤵
                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                PID:3448
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                56⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:3932
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                56⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:4916
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                56⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:3236
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                56⤵
                                                                                                                                                  PID:4164
                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                  "wmic.exe" os get Caption
                                                                                                                                                  56⤵
                                                                                                                                                    PID:2712
                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                    "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                    56⤵
                                                                                                                                                      PID:3896
                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                      "wmic.exe" csproduct get uuid
                                                                                                                                                      56⤵
                                                                                                                                                        PID:3764
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                        56⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        PID:1620
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic" path win32_VideoController get name
                                                                                                                                                        56⤵
                                                                                                                                                        • Detects videocard installed
                                                                                                                                                        PID:4716
                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                        56⤵
                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                        PID:2036
                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                          ping localhost
                                                                                                                                                          57⤵
                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:1268
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    54⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:516
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  53⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4808
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                52⤵
                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4104
                                                                                                                                                • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  53⤵
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:4552
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                  53⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:4356
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                  53⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:2840
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                  53⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:1252
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                  53⤵
                                                                                                                                                    PID:4712
                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                    "wmic.exe" os get Caption
                                                                                                                                                    53⤵
                                                                                                                                                      PID:4980
                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                      "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                      53⤵
                                                                                                                                                        PID:1028
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" csproduct get uuid
                                                                                                                                                        53⤵
                                                                                                                                                          PID:4780
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                          53⤵
                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                          PID:2440
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic" path win32_VideoController get name
                                                                                                                                                          53⤵
                                                                                                                                                          • Detects videocard installed
                                                                                                                                                          PID:2304
                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                          53⤵
                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                          PID:3536
                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                            ping localhost
                                                                                                                                                            54⤵
                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                            • Runs ping.exe
                                                                                                                                                            PID:1096
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      51⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2792
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    50⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2656
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  49⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1308
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                48⤵
                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4740
                                                                                                                                                • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  49⤵
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:3264
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                  49⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:1632
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                  49⤵
                                                                                                                                                    PID:2388
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                    49⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:3488
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                    49⤵
                                                                                                                                                      PID:5040
                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                      "wmic.exe" os get Caption
                                                                                                                                                      49⤵
                                                                                                                                                        PID:4272
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                        49⤵
                                                                                                                                                          PID:1744
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                          49⤵
                                                                                                                                                            PID:3248
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                            49⤵
                                                                                                                                                              PID:2024
                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                              "wmic" path win32_VideoController get name
                                                                                                                                                              49⤵
                                                                                                                                                              • Detects videocard installed
                                                                                                                                                              PID:4376
                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                              49⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              PID:440
                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                ping localhost
                                                                                                                                                                50⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:4640
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                          47⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2208
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        46⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4284
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      45⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4704
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    44⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4984
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                  43⤵
                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4800
                                                                                                                                                  • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    44⤵
                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                    PID:4288
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                    44⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:2440
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                    44⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:440
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                    44⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:756
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                    44⤵
                                                                                                                                                      PID:2156
                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                      "wmic.exe" os get Caption
                                                                                                                                                      44⤵
                                                                                                                                                        PID:2556
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                        44⤵
                                                                                                                                                          PID:3692
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                          44⤵
                                                                                                                                                            PID:5108
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                            44⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            PID:4108
                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                            "wmic" path win32_VideoController get name
                                                                                                                                                            44⤵
                                                                                                                                                            • Detects videocard installed
                                                                                                                                                            PID:1356
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                            44⤵
                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                            PID:664
                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                              ping localhost
                                                                                                                                                              45⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              • Runs ping.exe
                                                                                                                                                              PID:1472
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        42⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3772
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      41⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4408
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                    40⤵
                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4492
                                                                                                                                                    • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      41⤵
                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                      PID:4104
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                      41⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:2024
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                      41⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:1980
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      41⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:1308
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                      41⤵
                                                                                                                                                        PID:2168
                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                        "wmic.exe" os get Caption
                                                                                                                                                        41⤵
                                                                                                                                                          PID:2424
                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                          41⤵
                                                                                                                                                            PID:4884
                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                            41⤵
                                                                                                                                                              PID:2792
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                              41⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:3784
                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                              "wmic" path win32_VideoController get name
                                                                                                                                                              41⤵
                                                                                                                                                              • Detects videocard installed
                                                                                                                                                              PID:2728
                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                              41⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              PID:3212
                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                ping localhost
                                                                                                                                                                42⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:1484
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                          39⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4724
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        38⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2460
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                      37⤵
                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:920
                                                                                                                                                      • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                        38⤵
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:1972
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                        38⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        PID:4544
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                        38⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        PID:3872
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                        38⤵
                                                                                                                                                          PID:3992
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                          38⤵
                                                                                                                                                            PID:3988
                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                            38⤵
                                                                                                                                                              PID:2424
                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                              38⤵
                                                                                                                                                                PID:4688
                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                38⤵
                                                                                                                                                                  PID:3024
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                  38⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:4808
                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                  38⤵
                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                  PID:4888
                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                  38⤵
                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                  PID:2324
                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                    ping localhost
                                                                                                                                                                    39⤵
                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                    PID:1360
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                              36⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:864
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                            35⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2040
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                          34⤵
                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:3364
                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                            35⤵
                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                            PID:4576
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                            35⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            PID:2524
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                            35⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            PID:4844
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                            35⤵
                                                                                                                                                              PID:2976
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                              35⤵
                                                                                                                                                                PID:1844
                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                "wmic.exe" os get Caption
                                                                                                                                                                35⤵
                                                                                                                                                                  PID:4340
                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                  "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                  35⤵
                                                                                                                                                                    PID:1984
                                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                    "wmic.exe" csproduct get uuid
                                                                                                                                                                    35⤵
                                                                                                                                                                      PID:4984
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                      35⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:4576
                                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                      "wmic" path win32_VideoController get name
                                                                                                                                                                      35⤵
                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                      PID:4920
                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                      35⤵
                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                      PID:2896
                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                        ping localhost
                                                                                                                                                                        36⤵
                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                        PID:3996
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:224
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                32⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3896
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                              31⤵
                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1968
                                                                                                                                                              • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                32⤵
                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                PID:2960
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                32⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                PID:1680
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                32⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                PID:1052
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                32⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                PID:4340
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                32⤵
                                                                                                                                                                  PID:1124
                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                  "wmic.exe" os get Caption
                                                                                                                                                                  32⤵
                                                                                                                                                                    PID:2188
                                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                    "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                    32⤵
                                                                                                                                                                      PID:2428
                                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                      "wmic.exe" csproduct get uuid
                                                                                                                                                                      32⤵
                                                                                                                                                                        PID:5100
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                        32⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        PID:2340
                                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                        "wmic" path win32_VideoController get name
                                                                                                                                                                        32⤵
                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                        PID:1156
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                        32⤵
                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                        PID:3696
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping localhost
                                                                                                                                                                          33⤵
                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:540
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                    30⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3064
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                  29⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2024
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                28⤵
                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:996
                                                                                                                                                                • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                  29⤵
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:1124
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                  29⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:4636
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                  29⤵
                                                                                                                                                                    PID:2080
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                    29⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:1476
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                    29⤵
                                                                                                                                                                      PID:4888
                                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                      "wmic.exe" os get Caption
                                                                                                                                                                      29⤵
                                                                                                                                                                        PID:3192
                                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                        "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                        29⤵
                                                                                                                                                                          PID:3260
                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                                          29⤵
                                                                                                                                                                            PID:1984
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                            29⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            PID:1528
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic" path win32_VideoController get name
                                                                                                                                                                            29⤵
                                                                                                                                                                            • Detects videocard installed
                                                                                                                                                                            PID:3624
                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                            29⤵
                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                            PID:3324
                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                              ping localhost
                                                                                                                                                                              30⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:3584
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                        27⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1968
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                      26⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:864
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                    25⤵
                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3928
                                                                                                                                                                    • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                      26⤵
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:544
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                      26⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:1740
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                      26⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:4196
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                      26⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:3356
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                      26⤵
                                                                                                                                                                        PID:5100
                                                                                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                        "wmic.exe" os get Caption
                                                                                                                                                                        26⤵
                                                                                                                                                                          PID:540
                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                          26⤵
                                                                                                                                                                            PID:3872
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                                            26⤵
                                                                                                                                                                              PID:1052
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                              26⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:1496
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic" path win32_VideoController get name
                                                                                                                                                                              26⤵
                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                              PID:3680
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                              26⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              PID:3548
                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                ping localhost
                                                                                                                                                                                27⤵
                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                PID:536
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          24⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3504
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                        23⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2452
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                      22⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3992
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                    21⤵
                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4484
                                                                                                                                                                    • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                      22⤵
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:3136
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                      22⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:1348
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                      22⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:1052
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                      22⤵
                                                                                                                                                                        PID:1272
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                        22⤵
                                                                                                                                                                          PID:4956
                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                          "wmic.exe" os get Caption
                                                                                                                                                                          22⤵
                                                                                                                                                                            PID:4464
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                            22⤵
                                                                                                                                                                              PID:4360
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" csproduct get uuid
                                                                                                                                                                              22⤵
                                                                                                                                                                                PID:5108
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                22⤵
                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                PID:2460
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic" path win32_VideoController get name
                                                                                                                                                                                22⤵
                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                PID:3820
                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                22⤵
                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                PID:2552
                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                  ping localhost
                                                                                                                                                                                  23⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:1932
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            20⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:1080
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          19⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4392
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                        18⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1172
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                      17⤵
                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2652
                                                                                                                                                                      • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                        18⤵
                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                        PID:3448
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                        18⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:1696
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                        18⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:3088
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                        18⤵
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:4376
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                        18⤵
                                                                                                                                                                          PID:2552
                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                          "wmic.exe" os get Caption
                                                                                                                                                                          18⤵
                                                                                                                                                                            PID:1256
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                            18⤵
                                                                                                                                                                              PID:3860
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" csproduct get uuid
                                                                                                                                                                              18⤵
                                                                                                                                                                                PID:1472
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                18⤵
                                                                                                                                                                                  PID:4888
                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                                  18⤵
                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                  PID:3364
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                  18⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:2996
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping localhost
                                                                                                                                                                                    19⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:3088
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                              16⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2232
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:452
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          14⤵
                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1716
                                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:3236
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:2388
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1308
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:3316
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1080
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            15⤵
                                                                                                                                                                              PID:3580
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                              15⤵
                                                                                                                                                                                PID:540
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                15⤵
                                                                                                                                                                                  PID:1788
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                  15⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:628
                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                                  15⤵
                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                  PID:1960
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                  15⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:2496
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping localhost
                                                                                                                                                                                    16⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:1212
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                              13⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4644
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4636
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          11⤵
                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3496
                                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:1696
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1348
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:3092
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:536
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:760
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:1940
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                              12⤵
                                                                                                                                                                                PID:1368
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                12⤵
                                                                                                                                                                                  PID:808
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                  12⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:3580
                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                                  12⤵
                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                  PID:4484
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                  12⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:2408
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping localhost
                                                                                                                                                                                    13⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:3928
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                              10⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:228
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:3132
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          8⤵
                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:740
                                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:3712
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1848
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1844
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:3980
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:2916
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:2972
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:2656
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:440
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:4400
                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                  PID:3712
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:3628
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping localhost
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:2420
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4744
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4680
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1332
                                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:2424
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1696
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:3204
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:3096
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:2960
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2656
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:1052
                                                                                                                                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                "wmic.exe" csproduct get uuid
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2608
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:2332
                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                  "wmic" path win32_VideoController get name
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                  PID:756
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:3180
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping localhost
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:4644
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5108
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:3184
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:5052
                                                                                                                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                                                                                                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:536
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe'
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:5056
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:3996
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:468
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2792
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" os get Caption
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:5100
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" computersystem get totalphysicalmemory
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:3244
                                                                                                                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                            "wmic.exe" csproduct get uuid
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1052
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:2736
                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                              "wmic" path win32_VideoController get name
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                              PID:1592
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe" && pause
                                                                                                                                                                              3⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:3372
                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                ping localhost
                                                                                                                                                                                4⤵
                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                PID:2756
                                                                                                                                                                        • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                          C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2296

                                                                                                                                                                          Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Extreme Injector v3.exe.log
                                                                                                                                                                            Filesize

                                                                                                                                                                            654B

                                                                                                                                                                            MD5

                                                                                                                                                                            2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                            SHA1

                                                                                                                                                                            684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                            SHA256

                                                                                                                                                                            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                            SHA512

                                                                                                                                                                            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Extreme Injector.exe.log
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            4c8fa14eeeeda6fe76a08d14e08bf756

                                                                                                                                                                            SHA1

                                                                                                                                                                            30003b6798090ec74eb477bbed88e086f8552976

                                                                                                                                                                            SHA256

                                                                                                                                                                            7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

                                                                                                                                                                            SHA512

                                                                                                                                                                            116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                            SHA1

                                                                                                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                            SHA256

                                                                                                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7511c81925750deb7ad1b9b80eea8a8d

                                                                                                                                                                            SHA1

                                                                                                                                                                            6ea759b3cbd243ae11435c6d6c5ced185eb01f49

                                                                                                                                                                            SHA256

                                                                                                                                                                            5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa

                                                                                                                                                                            SHA512

                                                                                                                                                                            5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            a67eee085e8f68aaffbfdb51503d6561

                                                                                                                                                                            SHA1

                                                                                                                                                                            29db9b41945c6a5d27d5836a1c780668eded65a0

                                                                                                                                                                            SHA256

                                                                                                                                                                            6e155bcc98f4e175a8701f030b73b14d9002b175ef58a19cb9010af3964e36b4

                                                                                                                                                                            SHA512

                                                                                                                                                                            7923bc74260e77d62b20cf510b79e0422563469ec3543084a989db154b1e39370f1a6e6c6e73caa7471d0974a693b1beb4fd2ddfb14b0b5c58650b5df3c32d81

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            944B

                                                                                                                                                                            MD5

                                                                                                                                                                            96ff1ee586a153b4e7ce8661cabc0442

                                                                                                                                                                            SHA1

                                                                                                                                                                            140d4ff1840cb40601489f3826954386af612136

                                                                                                                                                                            SHA256

                                                                                                                                                                            0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

                                                                                                                                                                            SHA512

                                                                                                                                                                            3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            1d143d8f176947e4677211d4a25162e0

                                                                                                                                                                            SHA1

                                                                                                                                                                            8b595dccdc6dd126d7660cb074968b2e28ce7071

                                                                                                                                                                            SHA256

                                                                                                                                                                            5552727ed38222e454bf700c88d5b1d16823e2ffb095ecb0aa8c1d73b897eab8

                                                                                                                                                                            SHA512

                                                                                                                                                                            bc4096fd0f70abdf9286f44fa97d8dfb8773506c9358d9967fcade44f4686e647b0c394792bdf1c2df6888e0d20ce2e053a435f543c125629afcc90cbe394497

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            548dd08570d121a65e82abb7171cae1c

                                                                                                                                                                            SHA1

                                                                                                                                                                            1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                                                                                                                            SHA256

                                                                                                                                                                            cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                                                                                                                            SHA512

                                                                                                                                                                            37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            45ad40f012b09e141955482368549640

                                                                                                                                                                            SHA1

                                                                                                                                                                            3f9cd15875c1e397c3b2b5592805577ae88a96cb

                                                                                                                                                                            SHA256

                                                                                                                                                                            ea3b59172f1a33677f9cb3843fb4d6093b806d3a7cf2f3c6d4692f5421f656ce

                                                                                                                                                                            SHA512

                                                                                                                                                                            3de08f8affca1c1450088f560776cf3d65146cadac43c06eb922c7b3cea436e519966cf38458303ffeb1a58c53f8952cffda6c34216fda7594e014b516e83b33

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            37263f3583b3b49735278e7aaf03f804

                                                                                                                                                                            SHA1

                                                                                                                                                                            2e42bfbd1884ac1fb41b44587d715feec4505477

                                                                                                                                                                            SHA256

                                                                                                                                                                            d3d37a24d4c9be7f6771ae16f632836eef3149d7e857f55af8ec3cb3d88106af

                                                                                                                                                                            SHA512

                                                                                                                                                                            74e4a9e79ec26cf648ad24f0eec994cf81e2c3b7288a0a050799495712ba50d94bdac71d6b0c75d91c2aff2058ad180af4c85516d08a8d154038739ff3116ab8

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ec79fae4e7c09310ebf4f2d85a33a638

                                                                                                                                                                            SHA1

                                                                                                                                                                            f2bdd995b12e65e7ed437d228f22223b59e76efb

                                                                                                                                                                            SHA256

                                                                                                                                                                            e9c4723a5fe34e081c3d2f548a1d472394cc7aa58056fcf44ca542061381243a

                                                                                                                                                                            SHA512

                                                                                                                                                                            af9dda12f6bb388d826fe03a4a8beed9bda23a978aa55a2af6a43271660ee896a7ee3bcf2c4d2f1e6180902791d8c23560f1c2ec097a501d8c6f4f6c49075625

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            6fa824bd2105c1c0e5ede761a6f99774

                                                                                                                                                                            SHA1

                                                                                                                                                                            12efe87063d91fc69b33fa2384e05c6be23b7cfa

                                                                                                                                                                            SHA256

                                                                                                                                                                            cf3bf3e40d15122ba9ba119869802e2fed88a9d3667bbf53116a3dd343f35323

                                                                                                                                                                            SHA512

                                                                                                                                                                            5f8dbb41b4b77fd460771c83dbb7e008ac5dd06aad997a2472e0a100d16393f621f78e2e7f2d57b09ad791e52240a5713bcfd28e81ab766b6e0ed574db0a672f

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            86572804fb0bdd2bbf762b364716fa3d

                                                                                                                                                                            SHA1

                                                                                                                                                                            f621c716f077df240e14bce2773e5e0f644a67b7

                                                                                                                                                                            SHA256

                                                                                                                                                                            a32fd14193084b585effea61b38bbb6796f9717cfe9b278f8c35234df639c1e5

                                                                                                                                                                            SHA512

                                                                                                                                                                            6a4603512c7bf230aaf508a890f84c24c5b9278d834830d430e96a00f44e94ba37338ef623fb1837484f2e0f26a719a89615e4a724eddec30acafce9603cd9ae

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            da02a95b169ee0507779be78fc534652

                                                                                                                                                                            SHA1

                                                                                                                                                                            008a0f04246f51ef4fc3ed824e92a1118bc787e4

                                                                                                                                                                            SHA256

                                                                                                                                                                            dd74047461f8e3faf2c82cfa546ee3791f9b157b4055e5a7a04a194f5c25ce2e

                                                                                                                                                                            SHA512

                                                                                                                                                                            014d0011d0dddac0c25835dc0b332268cea1ab9acb4ecb753cf5b261c0600f541b0716751a11a2fe22e48c36692b96c0d22185f6ebb84ae90758ea412185e28a

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            8a424e81b5a6078deff05e153c04a0ee

                                                                                                                                                                            SHA1

                                                                                                                                                                            bf209de0dbc1dbe7c5b5b511bd34bf447a3c049b

                                                                                                                                                                            SHA256

                                                                                                                                                                            79ce6d6caea4a9eabf8fdbb2a1c58d43fb5a3c500c2dec3fce87c160d2c6bda3

                                                                                                                                                                            SHA512

                                                                                                                                                                            aa01195e5c1d641304b08fed4a3bffc916972aa0bc20e928204cef1783f38922a03b761cf2010ccbace1ea0d2f18cda4eaeee4d8969f32fbae5f580e4e38522d

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            944B

                                                                                                                                                                            MD5

                                                                                                                                                                            719fd150e78f630817910e72ad00fc16

                                                                                                                                                                            SHA1

                                                                                                                                                                            093ef625bd5e314e334cffda49458cde7b8a85aa

                                                                                                                                                                            SHA256

                                                                                                                                                                            17850f8bbb06ed6af4ba88f2c085dd1f3afa20f36f63dc20ad548c1ce61a9455

                                                                                                                                                                            SHA512

                                                                                                                                                                            cd8b52ddf31313f77f905b2203e55ec32e65cf2f47c828d3262b9fe2ec3cc2704d112ba3574be8967b704cb0c1fbc986665b40ab85b1ad129e5bc98354c8e175

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            df6c4e5c3091c14551e6c92f07717617

                                                                                                                                                                            SHA1

                                                                                                                                                                            1ea87111035496c1b2b74cef8b5c62d00ac072c9

                                                                                                                                                                            SHA256

                                                                                                                                                                            b79dc75372707ff84a643a9e4cff6fad2d1a936b54d458088850c62c96e2f231

                                                                                                                                                                            SHA512

                                                                                                                                                                            ab861efd0ff28a4bae3513a884d5b00c1b68d8f0bd54a00428bbb65a6954f8778e8f5300362025265251cb425c5ed77608b10776f382c3b392916ae46e38db35

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            944B

                                                                                                                                                                            MD5

                                                                                                                                                                            77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                                                            SHA1

                                                                                                                                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                                                            SHA256

                                                                                                                                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                                                            SHA512

                                                                                                                                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            227556da5e65f6819f477756808c17e4

                                                                                                                                                                            SHA1

                                                                                                                                                                            6ffce766e881ca2a60180bb25f4981b183f78279

                                                                                                                                                                            SHA256

                                                                                                                                                                            101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4

                                                                                                                                                                            SHA512

                                                                                                                                                                            d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ac057a92f4b62d8880169af0693ef5b2

                                                                                                                                                                            SHA1

                                                                                                                                                                            66e7c7834c5dae5cec863ccd69403150d05841f4

                                                                                                                                                                            SHA256

                                                                                                                                                                            7cef55990e8e6cfe07e1965b303e79ac562cdc128ab82edf480d9873f72bb3ed

                                                                                                                                                                            SHA512

                                                                                                                                                                            d525f47da9e61fc87e55aca6b34e776be3ed081b719bbbb5256705a6afe5fdd4c16d5ee595af13994e2718f789f5fd32830331347d97b029c031c9dfe30c7f49

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            c6aae9fb57ebd2ae201e8d174d820246

                                                                                                                                                                            SHA1

                                                                                                                                                                            58140d968de47bcf9c78938988a99369bbdb1f51

                                                                                                                                                                            SHA256

                                                                                                                                                                            bbc39a8da61fd8ec0d64e708e1ab4986f7fdf580581e464629bf040c595f7c08

                                                                                                                                                                            SHA512

                                                                                                                                                                            5959f7dab47bc4bad03635f497ca48f2e0740375528afddfc50964e54983e56df5970b25b8d8b28f1aa73cd6233fac83c634a311e759c58a365570e4862c3e3c

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            1166253bc7c5e1a13a3a3424ead43daa

                                                                                                                                                                            SHA1

                                                                                                                                                                            cc02321b9966caf12198faa0f11fb3a67cec40da

                                                                                                                                                                            SHA256

                                                                                                                                                                            5433e7929c149879ff12136cad46c4dc4d9b4fb7f09a429bcda60f9f77618ae0

                                                                                                                                                                            SHA512

                                                                                                                                                                            7c4405bfddde1396817eecf199abe3c7177d4ec4dd77b475c6e99acf82a1a82c6b99aaf1d15f3e37912c0eb59b679933b17e58e7eef2eb2352c9757fe0709ac8

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            4dcd3cacd3829a7fec233cb12257bcb2

                                                                                                                                                                            SHA1

                                                                                                                                                                            997f4b9498c1668c6462efebb1914a456f79c526

                                                                                                                                                                            SHA256

                                                                                                                                                                            77ee262e98be6e463a4ef4005be753a1fe44d9274ef2c683c54d62607bfc5c4b

                                                                                                                                                                            SHA512

                                                                                                                                                                            14679e20b70ea5d4d35ca5bef867303463bb3aeab82655de5d9b1979e4a573482739e54403f9752e32b641618e21268a3e9c07b621ae9bed1fcb39445efb7756

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            0741b8916a5707bca60f9fedad4336d8

                                                                                                                                                                            SHA1

                                                                                                                                                                            0e898fe2b3f1ff7fc5aa01a33bf536d53ef6f41d

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9238b71d3e4222ea3950e117b0e86aaf26cb2c9f5c8d5352ed1c133f7313050

                                                                                                                                                                            SHA512

                                                                                                                                                                            cf66b92d5ed7754faea99887f6d8ea8305e250bfe213df9a9fbea902775fa47054eb068694e4283001f595fcffb8e0dadd8e74563fbbf87a4a278dcff279f584

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            74a6b79d36b4aae8b027a218bc6e1af7

                                                                                                                                                                            SHA1

                                                                                                                                                                            0350e46c1df6934903c4820a00b0bc4721779e5f

                                                                                                                                                                            SHA256

                                                                                                                                                                            60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04

                                                                                                                                                                            SHA512

                                                                                                                                                                            60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            948B

                                                                                                                                                                            MD5

                                                                                                                                                                            966914e2e771de7a4a57a95b6ecfa8a9

                                                                                                                                                                            SHA1

                                                                                                                                                                            7a32282fd51dd032967ed4d9a40cc57e265aeff2

                                                                                                                                                                            SHA256

                                                                                                                                                                            98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

                                                                                                                                                                            SHA512

                                                                                                                                                                            dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            276798eeb29a49dc6e199768bc9c2e71

                                                                                                                                                                            SHA1

                                                                                                                                                                            5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                                                                                                            SHA256

                                                                                                                                                                            cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                                                                                                            SHA512

                                                                                                                                                                            0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ErDuhilN6Ophosy
                                                                                                                                                                            Filesize

                                                                                                                                                                            20KB

                                                                                                                                                                            MD5

                                                                                                                                                                            407ae3bb7c2fea6c3e6d49462ada12c4

                                                                                                                                                                            SHA1

                                                                                                                                                                            6184bcfd2e93e44e978a4f66432c8e60c85f1870

                                                                                                                                                                            SHA256

                                                                                                                                                                            0db4c6cbf57ed42e79e7400896359bba242f2e255b2e941ff10abc275cb47f2e

                                                                                                                                                                            SHA512

                                                                                                                                                                            96f739f6d318dcf9f58c70fcdfefa3e39aa74fd8724ac2e19699856abf545b9fc74eba053a4555c88cecbf6c7a59bd7a906885e4097fd3e04e525e77bb373e3e

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            231KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7d4400842d0ded3544bc7892c765816d

                                                                                                                                                                            SHA1

                                                                                                                                                                            c5a12688240f8db93e7482d16d145802445bfd71

                                                                                                                                                                            SHA256

                                                                                                                                                                            8b30696e9259851325272d57b9452ac2f6037231f1c6895658efb57e0445d064

                                                                                                                                                                            SHA512

                                                                                                                                                                            c6ba7dca5825784b680550d2cbc6528bcb0a5c1b6fbf2a65b2c54112a3c39858e01abb58915ff89c9c0011aa4200257659d516de6abd1f1d71e2eca0cadb065a

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\QxtXhoevwpft70f
                                                                                                                                                                            Filesize

                                                                                                                                                                            20KB

                                                                                                                                                                            MD5

                                                                                                                                                                            49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                            SHA1

                                                                                                                                                                            3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                            SHA256

                                                                                                                                                                            d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                            SHA512

                                                                                                                                                                            b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pohig4jr.ooz.ps1
                                                                                                                                                                            Filesize

                                                                                                                                                                            60B

                                                                                                                                                                            MD5

                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                            SHA1

                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                            SHA256

                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                            SHA512

                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aZOKvhvO4IcBoCA
                                                                                                                                                                            Filesize

                                                                                                                                                                            40KB

                                                                                                                                                                            MD5

                                                                                                                                                                            a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                            SHA1

                                                                                                                                                                            8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                            SHA256

                                                                                                                                                                            42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                            SHA512

                                                                                                                                                                            9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sA2VUkaL7U3CoYl
                                                                                                                                                                            Filesize

                                                                                                                                                                            48KB

                                                                                                                                                                            MD5

                                                                                                                                                                            349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                            SHA1

                                                                                                                                                                            bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                            SHA512

                                                                                                                                                                            2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\scwuc5npWRBcKEN\Browsers\Cookies\Chrome Cookies.txt
                                                                                                                                                                            Filesize

                                                                                                                                                                            260B

                                                                                                                                                                            MD5

                                                                                                                                                                            9bb582f7b2132836cc0c68636aba29c4

                                                                                                                                                                            SHA1

                                                                                                                                                                            a59e9e2139d2882a53e594d6c90db5c057c0fdf6

                                                                                                                                                                            SHA256

                                                                                                                                                                            0c4ea33c3ccf2494dcf142970bd95b42a88d031e1f480e916b90cdd5e9463324

                                                                                                                                                                            SHA512

                                                                                                                                                                            94a2f6820cced8416bac972f4a2d7ab27e62bb1fb477100a1e6a05dadeacd17f14e234f40e226d35d86bd5967c31f063b4b488a258185f23adc726a422e5e87e

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\scwuc5npWRBcKEN\Display\Display.png
                                                                                                                                                                            Filesize

                                                                                                                                                                            424KB

                                                                                                                                                                            MD5

                                                                                                                                                                            5d2406f2abb55699eda82e3edbe0e644

                                                                                                                                                                            SHA1

                                                                                                                                                                            b193ddfe4ed0211802d21a7c8c92190fbd461f1a

                                                                                                                                                                            SHA256

                                                                                                                                                                            723e63358e8b383ec9ad1e454b962502db7f41e4e96415d4f17569dfd81d6f24

                                                                                                                                                                            SHA512

                                                                                                                                                                            9738499b083e80ac1a29d7bf2d0a4cccad4b2ec6163837dab277c47a16e34f37b3bfbbfc1fdaa57ff60d051613444618e5aaa23f0c55683c86a26919bdcc24ba

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            4028457913f9d08b06137643fe3e01bc

                                                                                                                                                                            SHA1

                                                                                                                                                                            a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

                                                                                                                                                                            SHA256

                                                                                                                                                                            289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

                                                                                                                                                                            SHA512

                                                                                                                                                                            c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • memory/440-1062-0x0000024C301A0000-0x0000024C303BC000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.1MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2440-1051-0x0000024C668B0000-0x0000024C66ACC000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.1MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2576-1-0x0000000000860000-0x00000000009CC000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2576-2-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2576-0-0x00007FF8AC373000-0x00007FF8AC375000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            8KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2576-17-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2840-1211-0x0000025778000000-0x000002577821C000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.1MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3196-1412-0x0000022AFF620000-0x0000022AFF7C9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3704-84-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3704-16-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4104-1265-0x000001E09E850000-0x000001E09E9F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4492-1040-0x000001F0D6730000-0x000001F0D68D9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4740-1190-0x00000143704A0000-0x0000014370649000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4800-1116-0x000001DB18110000-0x000001DB182B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-45-0x0000016CC6900000-0x0000016CC6976000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            472KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-88-0x0000016CAC680000-0x0000016CAC68A000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            40KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-89-0x0000016CADF70000-0x0000016CADF82000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-47-0x0000016CADFC0000-0x0000016CADFDE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            120KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-46-0x0000016CC6980000-0x0000016CC69D0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            320KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-110-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-15-0x0000016CAC180000-0x0000016CAC1C0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            256KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5052-18-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5056-19-0x000001C37C600000-0x000001C37C622000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            136KB

                                                                                                                                                                            Download