Analysis
-
max time kernel
5s -
max time network
63s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03/04/2021, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
General
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
pony
http://www.oldhorse.info
Extracted
fickerstealer
deniedfight.com:80
Extracted
metasploit
windows/single_exec
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral1/memory/5480-207-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral1/memory/5480-208-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/5424-205-0x0000000001A20000-0x0000000001A6C000-memory.dmp Vidar behavioral1/memory/5424-209-0x0000000000400000-0x0000000000450000-memory.dmp Vidar -
XMRig Miner Payload 4 IoCs
resource yara_rule behavioral1/memory/5204-161-0x00000001402CA898-mapping.dmp xmrig behavioral1/memory/5204-159-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral1/memory/5204-163-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral1/memory/5204-233-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 4284 keygen-pr.exe 4344 keygen-step-1.exe 64 keygen-step-3.exe 1316 keygen-step-4.exe 2552 key.exe 2956 Setup.exe 4084 key.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 109 ipinfo.io 53 api.ipify.org 106 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2552 set thread context of 4084 2552 key.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 4272 taskkill.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 4544 PING.EXE 2092 PING.EXE 2220 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 107 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 118 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2956 Setup.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4392 4804 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 75 PID 4804 wrote to memory of 4392 4804 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 75 PID 4804 wrote to memory of 4392 4804 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 75 PID 4392 wrote to memory of 4284 4392 cmd.exe 78 PID 4392 wrote to memory of 4284 4392 cmd.exe 78 PID 4392 wrote to memory of 4284 4392 cmd.exe 78 PID 4392 wrote to memory of 4344 4392 cmd.exe 79 PID 4392 wrote to memory of 4344 4392 cmd.exe 79 PID 4392 wrote to memory of 4344 4392 cmd.exe 79 PID 4392 wrote to memory of 64 4392 cmd.exe 80 PID 4392 wrote to memory of 64 4392 cmd.exe 80 PID 4392 wrote to memory of 64 4392 cmd.exe 80 PID 4392 wrote to memory of 1316 4392 cmd.exe 81 PID 4392 wrote to memory of 1316 4392 cmd.exe 81 PID 4392 wrote to memory of 1316 4392 cmd.exe 81 PID 4284 wrote to memory of 2552 4284 keygen-pr.exe 82 PID 4284 wrote to memory of 2552 4284 keygen-pr.exe 82 PID 4284 wrote to memory of 2552 4284 keygen-pr.exe 82 PID 1316 wrote to memory of 2956 1316 keygen-step-4.exe 83 PID 1316 wrote to memory of 2956 1316 keygen-step-4.exe 83 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 2552 wrote to memory of 4084 2552 key.exe 84 PID 64 wrote to memory of 3556 64 keygen-step-3.exe 86 PID 64 wrote to memory of 3556 64 keygen-step-3.exe 86 PID 64 wrote to memory of 3556 64 keygen-step-3.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:4084
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵PID:3556
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4544
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe" 1 3.1617436063.60681d9f18c73 1016⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\THPQF21THH\multitimer.exe" 2 3.1617436063.60681d9f18c737⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\iyzmksy3qi4\KiffApp1.exe"C:\Users\Admin\AppData\Local\Temp\iyzmksy3qi4\KiffApp1.exe"8⤵PID:5376
-
-
C:\Users\Admin\AppData\Local\Temp\0jys2r335m1\rgvvapqltqu.exe"C:\Users\Admin\AppData\Local\Temp\0jys2r335m1\rgvvapqltqu.exe" /ustwo INSTALL8⤵PID:5424
-
-
C:\Users\Admin\AppData\Local\Temp\ihzgxwvrv2p\vpn.exe"C:\Users\Admin\AppData\Local\Temp\ihzgxwvrv2p\vpn.exe" /silent /subid=4828⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\is-5I63C.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-5I63C.tmp\vpn.tmp" /SL5="$1030E,15170975,270336,C:\Users\Admin\AppData\Local\Temp\ihzgxwvrv2p\vpn.exe" /silent /subid=4829⤵PID:5612
-
-
-
C:\Users\Admin\AppData\Local\Temp\bq4fhwxhafh\vict.exe"C:\Users\Admin\AppData\Local\Temp\bq4fhwxhafh\vict.exe" /VERYSILENT /id=5358⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\is-03TRO.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-03TRO.tmp\vict.tmp" /SL5="$10314,870426,780800,C:\Users\Admin\AppData\Local\Temp\bq4fhwxhafh\vict.exe" /VERYSILENT /id=5359⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\is-QGJ9F.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-QGJ9F.tmp\win1host.exe" 53510⤵PID:5488
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\afk0xjnbfp1\3wj2fbenhv1.exe"C:\Users\Admin\AppData\Local\Temp\afk0xjnbfp1\3wj2fbenhv1.exe" /VERYSILENT8⤵PID:5660
-
-
C:\Users\Admin\AppData\Local\Temp\3zmfge3mfgs\ob4odea3n5r.exe"C:\Users\Admin\AppData\Local\Temp\3zmfge3mfgs\ob4odea3n5r.exe"8⤵PID:5504
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\3zmfge3mfgs\ob4odea3n5r.exe"9⤵PID:5168
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
PID:2220
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j1hybpau4gt\app.exe"C:\Users\Admin\AppData\Local\Temp\j1hybpau4gt\app.exe" /8-238⤵PID:5480
-
-
C:\Users\Admin\AppData\Local\Temp\oyaadv1ve3z\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\oyaadv1ve3z\Setup3310.exe" /Verysilent /subid=5778⤵PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\wwdj2r1a1x4\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\wwdj2r1a1x4\cpyrix.exe" /VERYSILENT8⤵PID:5388
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵PID:2188
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"10⤵PID:224
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵PID:4880
-
-
-
C:\Users\Admin\AppData\Local\Temp\gd5fjfklte1\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\gd5fjfklte1\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\is-3Q8O3.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-3Q8O3.tmp\IBInstaller_97039.tmp" /SL5="$502B2,14574851,721408,C:\Users\Admin\AppData\Local\Temp\gd5fjfklte1\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:5620
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-KULV8.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵PID:4044
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-KULV8.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵PID:5768
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\juwpiltc3ow\tfndnifmwl3.exe"C:\Users\Admin\AppData\Local\Temp\juwpiltc3ow\tfndnifmwl3.exe" /quiet SILENT=1 AF=7568⤵PID:5704
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8WP6WZ3H79\setups.exe"C:\Users\Admin\AppData\Local\Temp\8WP6WZ3H79\setups.exe" ll5⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\is-PD62N.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-PD62N.tmp\setups.tmp" /SL5="$50058,635399,250368,C:\Users\Admin\AppData\Local\Temp\8WP6WZ3H79\setups.exe" ll6⤵PID:4768
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵PID:204
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:4076
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:4272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"4⤵PID:3408
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵PID:3160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵PID:4600
-
C:\Users\Admin\AppData\Roaming\ADAB.tmp.exe"C:\Users\Admin\AppData\Roaming\ADAB.tmp.exe"5⤵PID:4852
-
C:\Users\Admin\AppData\Roaming\ADAB.tmp.exe"C:\Users\Admin\AppData\Roaming\ADAB.tmp.exe"6⤵PID:1432
-
-
-
C:\Users\Admin\AppData\Roaming\AFDE.tmp.exe"C:\Users\Admin\AppData\Roaming\AFDE.tmp.exe"5⤵PID:4616
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:1184
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵PID:5204
-
-
-
C:\Users\Admin\AppData\Roaming\B1F2.tmp.exe"C:\Users\Admin\AppData\Roaming\B1F2.tmp.exe"5⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:5980
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:2092
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵PID:6124
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4104
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4888
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\is-1KNOG.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-1KNOG.tmp\Setup3310.tmp" /SL5="$1030C,138429,56832,C:\Users\Admin\AppData\Local\Temp\oyaadv1ve3z\Setup3310.exe" /Verysilent /subid=5771⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\is-U1MVT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-U1MVT.tmp\Setup.exe" /Verysilent2⤵PID:5188
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"3⤵PID:2072
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"3⤵PID:3652
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"3⤵PID:5836
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"3⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\is-MI8AJ.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-MI8AJ.tmp\LabPicV3.tmp" /SL5="$20444,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"4⤵PID:5164
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"3⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\is-HJGPD.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-HJGPD.tmp\lylal220.tmp" /SL5="$2044A,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"4⤵PID:5464
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"3⤵PID:5776
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"3⤵PID:6068
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"3⤵PID:6036
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"3⤵PID:6020
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"3⤵PID:5412
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-A6K6T.tmp\3wj2fbenhv1.tmp"C:\Users\Admin\AppData\Local\Temp\is-A6K6T.tmp\3wj2fbenhv1.tmp" /SL5="$1039E,2592217,780800,C:\Users\Admin\AppData\Local\Temp\afk0xjnbfp1\3wj2fbenhv1.exe" /VERYSILENT1⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\is-A77F0.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-A77F0.tmp\winlthsth.exe"2⤵PID:4648
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5964